refactor: unify OpenAI provider identity#88217
Conversation
openclaw-barnacle
Bot
added
docs
|
Codex review: needs real behavior proof before merge. Reviewed May 30, 2026, 4:10 AM ET / 08:10 UTC. Summary Reproducibility: yes. source-level reproduction is high confidence: a legacy Review metrics: 2 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Security Review findings
Review detailsBest possible solution: Keep the canonical Do we have a high-confidence way to reproduce the issue? Yes, source-level reproduction is high confidence: a legacy Is this the best way to solve the issue? No, not yet: unifying on Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model gpt-5.5, reasoning high; reviewed against 915f88a0a3ed. Label changesLabel justifications:
Evidence reviewedWhat I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b6b80dfdc7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "realtimeVoiceProviders": ["openai"], | ||
| "memoryEmbeddingProviders": ["openai"], | ||
| "mediaUnderstandingProviders": ["openai", "openai-codex"], | ||
| "mediaUnderstandingProviders": ["openai"], |
There was a problem hiding this comment.
Existing configs and persisted active-model state can still name the media-understanding provider as openai-codex (for example tools.media.audio/image or a legacy openai-codex/* active model). After this manifest now declares only openai, the media registry has no aliasing path for openai-codex—getMediaUnderstandingProvider() just normalizes the id and does a map lookup—so those requests return no provider and audio/image understanding is skipped instead of using the unified OpenAI provider. Keep a registered/metadata alias or migrate these media provider ids before dropping the contract entry.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
the
rating: 🌊 off-meta tidepool
openclaw-barnacle
Bot
added
extensions: llm-task
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c80d0b6c94
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }, | ||
| ], | ||
| auth: [ | ||
| ...buildOpenAIChatGPTAuthMethods(), |
There was a problem hiding this comment.
When a user has only the new ChatGPT/Codex OAuth profile under openai, adding these auth methods makes provider-level checks report that openai is authenticated, but the model picker still calls params.hasAuth(normalizedRef.provider) without entry.api (src/flows/model-picker.ts:338). As a result, direct OpenAI API catalog rows such as o1/o3 are offered even though getApiKeyForModel now rejects OAuth for non-openai-codex-responses models, so selecting one fails at run time instead of being filtered or requiring an API-key profile.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
rating: 🧂 unranked krab
steipete
force-pushed
the
refactor/unify-openai-codex
branch
from
c80d0b6 to
3239362
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3239362b87
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -550,7 +646,6 @@ function createOpenAIImageGenerationProviderBase(params: { | |||
| }): ImageGenerationProvider { | |||
| return { | |||
| id: params.id, | |||
There was a problem hiding this comment.
Existing configs can still store generation defaults as openai-codex/gpt-image-1 or openai-codex/sora-2 (the doctor migration is opt-in). After this provider no longer advertises the openai-codex alias, resolveCapabilityModelCandidates preserves those explicit provider/model refs and getImageGenerationProvider/getVideoGenerationProvider only resolve registered aliases, so configured image/video requests fail with “No ... provider registered” instead of using OpenAI. Keep the runtime alias until the shipped refs are migrated or repaired automatically.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
P2
steipete
force-pushed
the
refactor/unify-openai-codex
branch
from
ab521a8 to
b5eec43
Compare
steipete
force-pushed
the
refactor/unify-openai-codex
branch
from
b5eec43 to
411c168
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 411c1681a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| OPENAI_AUTH_PROVIDER_IDS.some( | ||
| (provider) => listProfilesForProvider(store, provider).length > 0, |
There was a problem hiding this comment.
When the agent auth store contains only an openai API-key profile, this check still treats Codex auth as available because it only checks for any openai/openai-codex profile. For an openai model resolved to openai-codex-responses, resolveCodexNativeSearchActivation then returns native_active, which suppresses the managed web_search tool and injects the Codex-native web_search even though there is no ChatGPT/Codex OAuth/token credential. The config-side check above already filters to oauth/token; the store-side check needs the same type filter.
Useful? React with 👍 / 👎.
1 participant
Summary
This refactor collapses OpenAI and legacy OpenAI Codex model identity onto the canonical
openaiprovider id.openai-codexprovider registration surface from the OpenAI plugin manifest and contract tests.openai-codex-responsesremains only as the internal API/transport backend for Codex/ChatGPT OAuth turns.openai-codexas doctor/compat input, not a normal provider namespace for new state. Setup choices, auth choice normalization, provider ownership, public artifacts, provider policy lookup, and plugin registry normalization now resolve that alias toopenai.openai/*rows can remain visible and route through Codex OAuth when that auth is selected.openclaw doctor --fixmigration for legacy OpenAI Codex auth/profile state. It rewritesopenai-codex:*profile ids,auth.order.openai-codex, scopedauthProfileIdrefs, usage stats, and old model refs, with backups and collision-safe canonical ids.openai:*profiles andauth:openaimigration items while still reading legacy source files that usedopenai-codex.openai-codexappears as legacy doctor-repaired state rather than recommended config.Migration notes
openclaw doctor --fixmigrates old state instead of carrying the old provider identity forward:openai-codex/<model>andcodex-cli/<model>model refs becomeopenai/<model>where the route is known to be canonical.openai-codex:*profile ids becomeopenai:*; if a canonical profile already exists, doctor allocates a safeopenai:chatgpt-*id rather than overwriting it.auth.order.openai-codexfolds intoauth.order.openaiwhile preserving usable order..openai-provider-unification.<timestamp>.bakbefore rewrite.openai-codex/*prefixes in place so the dedicated Codex route repair can preserve Codex runtime policy before canonicalizing.Behavior addressed
OpenAI has one model provider identity (
openai) regardless of API-key vs OAuth auth. Legacy Codex names are compatibility inputs and doctor migration targets, not a second provider namespace.Real environment tested
Local macOS checkout plus Blacksmith Testbox changed-gate run.
Exact steps or command run after this patch
OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test src/agents/auth-profiles/usage.test.ts src/agents/auth-profiles.markauthprofilefailure.test.ts src/agents/auth-profiles/order.test.ts src/commands/doctor/shared/codex-route-warnings.test.ts src/commands/doctor-auth-flat-profiles.test.ts extensions/openai/openai-provider.test.ts extensions/openai/openai-codex-provider.test.ts extensions/openai/image-generation-provider.test.ts extensions/openai/video-generation-provider.test.ts extensions/openai/openclaw.plugin.test.ts extensions/openai/index.test.ts extensions/openai/setup-api.test.ts extensions/openai/plugin-registration.contract.test.ts src/plugins/contracts/plugin-registration.openai.contract.test.ts extensions/openai/provider-auth.contract.test.ts extensions/openai/provider-runtime.contract.test.ts extensions/openai/provider-catalog.contract.test.ts extensions/openai/provider-policy-api.test.ts src/agents/auth-profiles/external-oauth.test.ts src/agents/auth-profiles/oauth.openai-codex-refresh-fallback.test.ts src/agents/openai-codex-routing.test.ts src/agents/model-auth.profiles.test.ts src/agents/model-catalog-visibility.test.ts src/agents/model-provider-auth.test.ts src/agents/embedded-agent-runner/model.inline-provider.test.ts src/plugin-sdk/provider-tools.test.ts src/commands/auth-choice.test.ts src/commands/auth-choice-legacy.test.ts src/commands/onboard-non-interactive/local/auth-choice.test.ts src/infra/provider-usage.shared.test.ts src/gateway/server-methods/models-auth-status.test.ts src/commands/models/list.status.test.ts src/agents/provider-attribution.test.ts src/agents/openai-transport-stream.test.ts src/agents/prompt-overlay-runtime-contract.test.ts src/plugins/providers.test.ts src/plugins/plugin-lookup-table.test.ts src/plugins/plugin-registry.test.ts src/plugins/provider-runtime.test.ts src/plugins/provider-public-artifacts.test.ts src/plugin-sdk/test-helpers/provider-auth-contract.ts src/plugin-sdk/test-helpers/provider-runtime-contract.ts src/plugin-sdk/test-helpers/plugin-registration-contract-cases.ts src/test-utils/plugin-registration.ts && pnpm check:test-typesnode scripts/crabbox-wrapper.mjs run --provider blacksmith-testbox --label openai-unification-check-changed-final --shell -- "git fetch origin main --deepen=1000 || git fetch origin main --unshallow || git fetch origin main --depth=5000; corepack pnpm check:changed"OPENCLAW_VITEST_MAX_WORKERS=1 pnpm test extensions/llm-task/src/llm-task-tool.test.ts extensions/codex/src/migration/provider.test.ts extensions/migrate-hermes/provider.secret-failure.test.ts extensions/migrate-hermes/secrets.test.ts src/commands/migrate.test.ts src/commands/doctor/shared/legacy-config-migrate.test.ts src/commands/doctor/shared/codex-route-warnings.test.ts && pnpm check:test-typespnpm docs:listgit diff --check.agents/skills/autoreview/scripts/autoreview --mode localEvidence after fix
pnpm check:test-types.pnpm check:test-types.tbx_01ksvf9cp94721hbx0f6z7s2gv:pnpm check:changedpassed core, core tests, extensions, extension tests, docs lanes; typecheck, lint, import cycles, and guards clean.git diff --check: clean.autoreview clean: no accepted/actionable findings reported.b6b80dfdc7,c80d0b6c94.Observed result after fix
Legacy OpenAI Codex references are normalized/migrated into
openai; OpenAI OAuth remains usable for Codex-routable canonical GPT rows; direct OpenAI Platform models still require API-key auth; doctor preserves existing canonical profiles instead of overwriting them during migration. Codex CLI, Hermes, and OpenCode imports now create canonicalopenaiauth profiles instead of creating freshopenai-codexstate.What was not tested
No live OpenAI/Codex OAuth turn or live OpenAI Platform API-key call was run from this branch.