fix(profiles): authenticate ClawHub Codex judge

[Patrick-Erichsen]

Summary

• authenticate the built-in clawhub and clawhub-aig Codex judges when operators provide only OPENAI_API_KEY
• preserve an explicitly supplied CODEX_API_KEY
• cover fallback and precedence behavior for both embedded profiles

Root cause

ClawScan allowlisted both credential names but launched codex exec without translating OPENAI_API_KEY. Codex CLI 0.142.3 reads CODEX_API_KEY for non-interactive exec authentication, so a valid OpenAI key reached the sandbox but was not attached to judge requests.

Validation

• go test ./internal/profiles -count=1
• go vet ./...
• .agents/skills/autoreview/scripts/autoreview --mode local (clean)
• live Codex control: the same key succeeds when exposed as CODEX_API_KEY

go test -count=1 ./... also ran locally. Unrelated existing macOS temp-path assertions fail on /var versus /private/var in internal/installpolicy and internal/runner; Linux CI is the required full-suite gate before merge.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 15, 2026, 12:03 AM ET / 04:03 UTC.

ClawSweeper review

What this changes

The PR maps an operator-supplied OpenAI API key to the Codex CLI credential name for the built-in ClawHub judge profiles while preserving an explicit Codex key.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open: current main still passes both credential names into the ClawHub judge sandbox but invokes Codex without the needed alias, while this focused PR repairs that gap without changing explicit Codex-key precedence.

Priority: P2
Reviewed head: 7d98ef604f47a6f287718fef717ff9a115b1a283

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	This is a focused, source-backed repair with appropriate regression coverage and no actionable correctness or security finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: The author is a repository collaborator, so the external-contributor proof gate does not apply; the PR body also reports a live Codex control.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The author is a repository collaborator, so the external-contributor proof gate does not apply; the PR body also reports a live Codex control.
Evidence reviewed	8 items	Current main lacks the credential alias: Both built-in ClawHub profiles allowlist OPENAI_API_KEY and CODEX_API_KEY, but their judge commands begin directly with codex exec. Credentials enter the existing judge sandbox: The Docker command runner passes configured environment names only when their values are present, so the profile allowlist reaches the judge process without placing values in command arguments. Patch preserves precedence in both profiles: The submitted commit adds a shell guard before each Codex command: an existing CODEX_API_KEY wins; otherwise OPENAI_API_KEY is exported under that name.
Findings	None	None.
Security	None	None.

How this fits together

ClawScan resolves a profile into scanner and external judge commands, then forwards only allowlisted environment names into the Docker sandbox. The ClawHub profiles run Codex as the judge and store its result in the scan artifact.

flowchart LR
  A[Operator credentials] --> B[ClawHub profile]
  B --> C[Profile resolver]
  C --> D[Sandbox environment allowlist]
  D --> E[Codex judge command]
  E --> F[Judge result artifact]

Loading

Before merge

• Resolve merge risk (P1) - The structured autoreview helper could not run because the restricted environment has no usable temporary directory; direct source review found no discrete patch defect.
• Complete next step (P2) - An open collaborator-authored implementation PR already owns the narrow repair; await standard review and the pending checks.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	2 files affected; production +2, tests +45	The behavior change is confined to the two embedded judge commands and adds fallback and precedence coverage.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Complete the pending CI checks and merge the profile-local alias so existing OPENAI_API_KEY-only ClawHub judge setups authenticate without changing the public CLI.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Complete the pending CI checks and merge the profile-local alias so existing OPENAI_API_KEY-only ClawHub judge setups authenticate without changing the public CLI.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main forwards OPENAI_API_KEY to the judge sandbox but does not translate it before the Codex command; the shell fallback and precedence behavior were directly checked with marker values.

Is this the best way to solve the issue?

Yes: the profile-local guard repairs the credential mismatch at the command boundary, preserves explicit CODEX_API_KEY behavior, and adds no public configuration surface.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 04401337b3ad.

Labels

Label changes:

• add P2: This fixes authentication for two built-in judge profiles with a bounded operator impact.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a repository collaborator, so the external-contributor proof gate does not apply; the PR body also reports a live Codex control.

Label justifications:

• P2: This fixes authentication for two built-in judge profiles with a bounded operator impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The author is a repository collaborator, so the external-contributor proof gate does not apply; the PR body also reports a live Codex control.

Evidence

What I checked:

• Current main lacks the credential alias: Both built-in ClawHub profiles allowlist OPENAI_API_KEY and CODEX_API_KEY, but their judge commands begin directly with codex exec. (internal/profiles/clawhub/clawscan.yml:10, 04401337b3ad)
• Credentials enter the existing judge sandbox: The Docker command runner passes configured environment names only when their values are present, so the profile allowlist reaches the judge process without placing values in command arguments. (internal/runner/sandbox.go:199, 04401337b3ad)
• Patch preserves precedence in both profiles: The submitted commit adds a shell guard before each Codex command: an existing CODEX_API_KEY wins; otherwise OPENAI_API_KEY is exported under that name. (internal/profiles/clawhub/clawscan.yml:14, 7d98ef604f47)
• Regression coverage exercises both branches: The added profile test executes the command prefix for both embedded profiles and checks OpenAI fallback plus explicit Codex-key precedence. (internal/profiles/resolver_test.go:105, 7d98ef604f47)
• Shell behavior verified without credentials: A clean shell environment produced openai-marker when only OPENAI_API_KEY was set and codex-marker when both markers were set.
• Feature provenance: The current ClawHub profile traces entirely to the profile change that introduced its current shape; resolver and sandbox maintenance has subsequently been concentrated in the related profile/sandbox commits. (internal/profiles/clawhub/clawscan.yml:4, 1d3ca1a27e69)

Likely related people:

• Patrick Erichsen: Current ClawHub profile history and blame trace to the profile change authored by Patrick Erichsen. (role: introduced the ClawHub profile and recent area contributor; confidence: high; commits: 1d3ca1a27e69; files: internal/profiles/clawhub/clawscan.yml)
• Jesse Merhi: Recent history covers the resolver and Docker sandbox environment boundary that carries the profile credentials. (role: recent profile resolver and sandbox contributor; confidence: high; commits: a9b45ab69396, e63bacb73e8e; files: internal/profiles/resolver.go, internal/runner/sandbox.go)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[Patrick-Erichsen]

Closeout proof for the two review checklist items:

• Local structured autoreview completed cleanly with no accepted/actionable findings.
• All exact-head checks on 7d98ef604f47a6f287718fef717ff9a115b1a283 are complete and green.
• Live AWS Crabbox proof exercised the formerly broken OPENAI_API_KEY-only path: both scanners completed, the Codex judge completed, gate passed, and the profile produced a suspicious verdict. Cold profile: 78.78s (SkillSpector 55.63s). Warm repeat: 44.80s (SkillSpector 16.19s).
• Proof runs: https://crabbox.openclaw.ai/portal/runs/run_f5f4d73cdb84 and https://crabbox.openclaw.ai/portal/runs/run_0dd6afb8a347