Clashing OpenAI Codex 0AUTH tokens | Friends of the Crustacean 🦞🤝 | Page 1

fluid bone Apr 12, 2026, 8:21 PM

#

I am hitting an issue where I have stale token for one of my agents, and another token for main, using OpenAI 0AUTH login

Main is not supposed to use this model, not as default at least
The agent with the expired token is somehow still working, but showing stale in config

Last command used to update sub agent token ended up doing this:

linuxuser@sera-gateway:~$ docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models auth login --provider openai-codex --set-default'
Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)

🦞 OpenClaw 2026.4.11 (unknown) — Type the command with confidence—nature will provide the stack trace if needed.

│
◇ Config warnings ─────────────────────────────────────────────────────────────────────╮
│ │
│ - plugins.allow: plugin not found: auth (stale config entry ignored; remove it from │
│ plugins config) │
│ │
├───────────────────────────────────────────────────────────────────────────────────────╯
│
◇ OpenAI Codex OAuth ─────────────────────────────────────────╮
│ │
│ You are running in a remote/VPS environment. │
│ A URL will be shown for you to open in your LOCAL browser. │
│ After signing in, paste the redirect URL back here. │
│ │
├──────────────────────────────────────────────────────────────╯
│
◇ OAuth URL ready

Open this URL in your LOCAL browser:

https://auth.openai.com/oauth/authorize?response_type=code&client_id=app_REDACTED

│
◇ Paste the authorization code (or full redirect URL):
│ http://localhost:1455/auth/callback?code=REDACTED
e+email+offline_access&state=0b6929b4f6061c98303e8540e329d3eb
Config warnings:

plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)
Config overwrite: /home/node/.openclaw/openclaw.json (sha256 4bf514b76974d34c8a1b8c065b18977e76b1c444217a0b7239910ab410cbb574 -> 21810517765109851ae105e1bf9666f02ffe94e28fa29a7dca57ad71fd9dc508, backup=/home/node/.openclaw/openclaw.json.bak)
Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)
Updated ~/.openclaw/openclaw.json
Auth profile: openai-codex:REDACTED (openai-codex/oauth)
Default model set to openai-codex/gpt-5.4
Tip: Codex-capable models can use native Codex web search. Enable it with openclaw configure --section web (recommended mode: cached). Docs: https://docs.openclaw.ai/tools/web

I only want 1 auth token and for specific agent profile to use its model as default

celest raptorBOT Apr 12, 2026, 8:21 PM

#

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

visual havenBOT Apr 12, 2026, 8:21 PM

#

languid tokenBOT Apr 12, 2026, 8:27 PM

#

First, can you paste the exact output of:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw --version'

Based on the 2026.4.11 banner though, this looks like current behavior, not you going crazy.

What happened:

openclaw models auth login --provider openai-codex --set-default did two things:
1. stored/refreshed an openai-codex OAuth profile
2. changed agents.defaults.model.primary to openai-codex/gpt-5.4
models auth login currently has no --agent flag, so it did not target only your sub-agent. It hit the configured default agent.

Why the “expired” agent can still work:

#

auth secrets live in ~/.openclaw/agents/<agentId>/agent/auth-profiles.json
config auth.profiles / auth.order is metadata/routing, not the secret store
auth profile choice is pinned per session, so an old session can keep using what it already picked until /new or /reset
if this is a spawned sub-agent, main auth is merged in as fallback, so the sub-agent can still run even if its own stored profile looks stale

What you want is:

keep main on its real default model
set only the target agent’s model via agents.list[].model
optionally pin auth order so only the intended Codex profile is used

Recommended cleanup:

Put main back on the model it should use

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models set <your-main-model>'

#

In /home/node/.openclaw/openclaw.json, keep Codex only on the specific agent:

{
  agents: {
    defaults: {
      model: { primary: "<your-main-model>" }
    },
    list: [
      {
        id: "<agentId>",
        model: { primary: "openai-codex/gpt-5.4" }
      }
    ]
  }
}

#

Check what each agent is actually using:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --agent main'
docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --agent <agentId>'
docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models auth order get --provider openai-codex --agent <agentId>'

If auth order is pinned to an old profile, clear or reset it:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models auth order clear --provider openai-codex --agent <agentId>'

Important caveat:

For named agents, OpenClaw auth is per-agent, not one shared OAuth store.
So “1 token shared cleanly across main + another named agent” is not really first-class yet.
If you mean a spawned sub-agent, main-fallback auth can make it look shared.

#

The warning is separate:

plugins.allow: plugin not found: auth is stale config junk
clean it with:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw doctor --fix'

Docs:

If you paste:

openclaw --version

#

your target agentId
the two models status --probe --agent ... outputs

…I can tell you exactly which profile is actually winning and the cleanest final config.

fluid bone Apr 12, 2026, 8:28 PM

#

Please proceed in a step by step cadence. 1 msg, 1 step, with all command blocks 1 click copyable:

linuxuser@sera-gateway:~$ docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw --version'
OpenClaw 2026.4.11

languid tokenBOT Apr 12, 2026, 8:29 PM

#

Step 1, let’s identify the exact agent IDs first so we don’t guess.

Run this and paste the output:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw agents list --bindings'

fluid bone Apr 12, 2026, 8:31 PM

#

◇ Config warnings ─────────────────────────────────────────────────────────────────────╮
│ │
│ - plugins.allow: plugin not found: auth (stale config entry ignored; remove it from │
│ plugins config) │
│ │
├───────────────────────────────────────────────────────────────────────────────────────╯
Agents:

main (default)
Workspace: ~/.openclaw/workspace
Agent dir: ~/.openclaw/agents/main/agent
Model: google/gemini-3-flash-preview
Routing rules: 0
Routing: default (no explicit rules)
Providers:
- Discord default: configured
- Telegram default: configured
jax
Identity: Jax (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/jax
Agent dir: ~/.openclaw/agents/jax/agent
Model: openai-codex/gpt-5.4
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
  Routing rules:
- discord peer=channel:1478059393927876624
augustus
Identity: Augustus Cipher (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/augustus
Agent dir: ~/.openclaw/agents/augustus/agent
Model: content
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
  Routing rules:
- discord peer=channel:1473496386317324298
quincy
Identity: Quincy Sterling (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/quincy
Agent dir: ~/.openclaw/agents/quincy/agent
Model: content
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
  Routing rules:
- discord peer=channel:1478059542334935112
silas
Identity: Silas Renner (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/silas
Agent dir: ~/.openclaw/agents/silas/agent
Model: learn
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
  Routing rules:
- discord peer=channel:1473491910999019611
sloan
Identity: Sloan Voss (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/sloan
Agent dir: ~/.openclaw/agents/sloan/agent
Model: logic
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
  Routing rules:
- discord peer=channel:1473490769208934400
logo-refiner
Workspace: ~/.openclaw/workspace/subagents/logo-refiner
Agent dir: ~/.openclaw/agents/logo-refiner/agent
Model: img
Routing rules: 0
img-temp
Workspace: ~/.openclaw/workspace/subagents/img-temp
Agent dir: ~/.openclaw/agents/img-temp/agent
Model: img
Routing rules: 0
Routing rules map channel/account/peer to an agent. Use --bindings for full rules.
Channel status reflects local config/creds. For live health: openclaw channels status --probe.

Logo refiner and img temp seem like random spawned sub agents that I want to remove also

languid tokenBOT Apr 12, 2026, 8:31 PM

#

Perfect, jax is the Codex agent. We’ll clean up logo-refiner and img-temp after we untangle auth.

Step 2, let’s see which auth/profile is actually being used by main vs jax.

Run this and paste the output:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'echo "=== main ==="; openclaw models status --probe --agent main; echo; echo "=== jax ==="; openclaw models status --probe --agent jax'

fluid bone Apr 12, 2026, 8:38 PM

#

Part 1/2

◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/main/agent
Default (agent): google/gemini-3-flash-preview
Fallbacks (1) (agent): google/gemini-2.5-pro
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (0) : -
Configured models (1): openai-codex/gpt-5.4

Auth overview
Auth store : ~/.openclaw/agents/main/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status

openai-codex usage: 5h 52% left ⏱1h · Week 0% left ⏱3d 20h
- openai-codex:REDACTEDe (REDACTED) ok expires in 10d

=== jax ===
Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)

🦞 OpenClaw 2026.4.11 (unknown) — You had me at 'openclaw gateway start.'

Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)
│
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/jax/agent
Default (agent): openai-codex/gpt-5.4
Fallbacks (1) (agent): openrouter/openai/gpt-5.3-codex
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (0) : -
Configured models (1): openai-codex/gpt-5.4

Auth overview
Auth store : ~/.openclaw/agents/jax/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (2)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=2 (oauth=2, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED), openai-codex:default=OAuth
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status
[openai-codex] Token refresh failed: 401 {
"error": {
"message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
"type": "invalid_request_error",
"param": null,
"code": "refresh_token_reused"
}
}

openai-codex usage: 5h 52% left ⏱59m · Week 0% left ⏱3d 20h
- openai-codex:REDACTED (REDACTED) ok expires in 10d
- openai-codex:default ok expires in 0m

#

Part 2/2

Auth probes
┌───────────────────────────────────────┬──────────────────────────────────────────────────────────────┬──────────────────────────────────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────────────┼──────────────────────────────────────────────────────────────┼──────────────────────────────────────────┤
│ google/gemini-3.1-flash-image-preview │ google:default (api_key) │ ok · 6.4s │
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ timeout · 18.5s │
│ │ │ ↳ LLM request timed out. │
│ openrouter/openai/gpt-5.3-codex │ openrouter:default (api_key) │ timeout · 19.9s │
│ │ │ ↳ LLM request timed out. │
└───────────────────────────────────────┴──────────────────────────────────────────────────────────────┴──────────────────────────────────────────┘
Probed 3 targets in 41.8s

languid tokenBOT Apr 12, 2026, 8:38 PM

#

Nice, this is the smoking gun.

jax is seeing two openai-codex profiles, and one of them is the stale openai-codex:default that is throwing refresh_token_reused.

Step 3, let’s check whether auth order is explicitly pinning the wrong profile.

Run this and paste the output:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'echo "=== main order ==="; openclaw models auth order get --provider openai-codex --agent main --json; echo; echo "=== jax order ==="; openclaw models auth order get --provider openai-codex --agent jax --json'

#

I think Discord split the previous models status --probe output, so we still haven’t got the auth-order check yet.

Step 3 again, same command:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'echo "=== main order ==="; openclaw models auth order get --provider openai-codex --agent main --json; echo; echo "=== jax order ==="; openclaw models auth order get --provider openai-codex --agent jax --json'

fluid bone Apr 12, 2026, 8:39 PM

#

=== main order ===
Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)
{
"agentId": "main",
"agentDir": "/home/node/.openclaw/agents/main/agent",
"provider": "openai-codex",
"authStatePath": "~/.openclaw/agents/main/agent/auth-state.json",
"order": null
}

=== jax order ===
Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)
{
"agentId": "jax",
"agentDir": "/home/node/.openclaw/agents/jax/agent",
"provider": "openai-codex",
"authStatePath": "~/.openclaw/agents/jax/agent/auth-state.json",
"order": null
}

languid tokenBOT Apr 12, 2026, 8:39 PM

#

Good, that rules out auth-state.json. No explicit auth-order pin is forcing the wrong profile.

Step 4, let’s inspect the actual stored openai-codex profile IDs in main and jax without dumping secrets.

Run this and paste the output:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node -e '"'"'const fs=require("fs"); const paths=["/home/node/.openclaw/agents/main/agent/auth-profiles.json","/home/node/.openclaw/agents/jax/agent/auth-profiles.json"]; for (const p of paths){ const j=JSON.parse(fs.readFileSync(p,"utf8")); console.log("===",p,"==="); for (const [id,v] of Object.entries(j.profiles||{})){ if(id.startsWith("openai-codex:")) console.log(id, v.expires ? new Date(v.expires).toISOString() : "no-expires"); } }'"'"''

fluid bone Apr 12, 2026, 8:40 PM

#

=== /home/node/.openclaw/agents/main/agent/auth-profiles.json ===
openai-codex:REDACTED 2026-04-22T20:12:20.904Z
=== /home/node/.openclaw/agents/jax/agent/auth-profiles.json ===
openai-codex:default 2026-04-05T16:26:22.722Z

languid tokenBOT Apr 12, 2026, 8:40 PM

#

Perfect, we found it.

main has the only good openai-codex OAuth profile
jax has only the stale openai-codex:default
that’s why jax still works, it’s effectively seeing main’s fresh profile while still carrying its own dead one

Step 5, let’s back up both auth stores before cleanup:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'ts=$(date +%s); cp /home/node/.openclaw/agents/main/agent/auth-profiles.json /home/node/.openclaw/agents/main/agent/auth-profiles.json.bak.$ts && cp /home/node/.openclaw/agents/jax/agent/auth-profiles.json /home/node/.openclaw/agents/jax/agent/auth-profiles.json.bak.$ts && echo "Backed up main and jax auth-profiles.json as .bak.$ts"'

fluid bone Apr 12, 2026, 8:41 PM

#

Backed up main and jax auth-profiles.json as .bak.1776026472

languid tokenBOT Apr 12, 2026, 8:41 PM

#

Nice. Step 6, remove only the stale openai-codex:default from jax and leave main alone.

Run this:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node -e '"'"'const fs=require("fs"); const p="/home/node/.openclaw/agents/jax/agent/auth-profiles.json"; const j=JSON.parse(fs.readFileSync(p,"utf8")); delete (j.profiles||{})["openai-codex:default"]; fs.writeFileSync(p, JSON.stringify(j,null,2)+"\n"); console.log("Removed openai-codex:default from", p);'"'"''

fluid bone Apr 12, 2026, 8:41 PM

#

Removed openai-codex:default from /home/node/.openclaw/agents/jax/agent/auth-profiles.json

languid tokenBOT Apr 12, 2026, 8:42 PM

#

Great. Step 7, verify that jax no longer carries the stale local profile and now resolves cleanly.

Run this and paste the output:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'echo "=== jax stored profiles ==="; node -e '"'"'const fs=require("fs"); const p="/home/node/.openclaw/agents/jax/agent/auth-profiles.json"; const j=JSON.parse(fs.readFileSync(p,"utf8")); console.log(Object.keys(j.profiles||{}));'"'"'; echo; echo "=== jax status ==="; openclaw models status --probe --agent jax'

fluid bone Apr 12, 2026, 8:44 PM

#

=== jax stored profiles ===
[ 'google:default', 'openrouter:default' ]

=== jax status ===
Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)

🦞 OpenClaw 2026.4.11 (unknown) — We ship features faster than Apple ships calculator updates.

Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)
│
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/jax/agent
Default (agent): openai-codex/gpt-5.4
Fallbacks (1) (agent): openrouter/openai/gpt-5.3-codex
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (0) : -
Configured models (1): openai-codex/gpt-5.4

Auth overview
Auth store : ~/.openclaw/agents/jax/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status

openai-codex usage: 5h 52% left ⏱50m · Week 0% left ⏱3d 20h
- openai-codex:REDACTED (REDACTED) ok expires in 10d

Auth probes
┌───────────────────────────────────────┬──────────────────────────────────────────────────────────────┬──────────────────────────────────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────────────┼──────────────────────────────────────────────────────────────┼──────────────────────────────────────────┤
│ google/gemini-3.1-flash-image-preview │ google:default (api_key) │ ok · 7.6s │
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ timeout · 17.5s │
│ │ │ ↳ LLM request timed out. │
│ openrouter/openai/gpt-5.3-codex │ openrouter:default (api_key) │ timeout · 19.2s │
│ │ │ ↳ LLM request timed out. │
└───────────────────────────────────────┴──────────────────────────────────────────────────────────────┴──────────────────────────────────────────┘
Probed 3 targets in 41.7s

2 auths timing out there

languid tokenBOT Apr 12, 2026, 8:45 PM

#

Yep, those probe timeout lines are a separate issue. They are not the duplicate-token problem anymore.

Right now the auth state is clean:

jax no longer has a stale local openai-codex token
there is now effectively 1 Codex OAuth token, the good one under main
jax is still using openai-codex/gpt-5.4 as its default model

Step 8, let’s clean the stale config warning next:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw doctor --fix'

fluid bone Apr 12, 2026, 8:47 PM

#

Discord: ok (@REDACTED) (196ms)
Telegram: ok (@REDACTED) (245ms)
Agents: main (default), jax, augustus, quincy, silas, sloan, logo-refiner, img-temp
Heartbeat interval: 4h (main)
Session store (main): /home/node/.openclaw/agents/main/sessions/sessions.json (21 entries)

agent:main:main (57m ago)
agent:main:cron:ff8c896f-1324-492f-b02d-6e5b44e8b9f0 (8830m ago)
agent:main:cron:535a7507-7858-4cf7-ada9-fca9b60ecd4f (9766m ago)
agent:main:discord:channel:1473501931573084332 (14597m ago)
agent:main:discord:channel:1486404713187512542 (19020m ago)
Config warnings:\n- plugins.allow: plugin not found: auth (stale config entry ignored; remove it from plugins config)
Config overwrite: /home/node/.openclaw/openclaw.json (sha256 21810517765109851ae105e1bf9666f02ffe94e28fa29a7dca57ad71fd9dc508 -> 4f11373af36bf7802c984e3c91f3b3fbbbce8e938a7da229b635c61a7c918c3c, backup=/home/node/.openclaw/openclaw.json.bak)
Updated ~/.openclaw/openclaw.json
Backup: ~/.openclaw/openclaw.json.bak
│
└ Doctor complete.

languid tokenBOT Apr 12, 2026, 8:47 PM

#

Nice, doctor finished. Next, let’s remove the two temp agents you called out. This is pretty safe here, they have Routing rules: 0, and agents delete moves them to Trash instead of hard-deleting.

Step 9:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw agents delete logo-refiner --force && openclaw agents delete img-temp --force'

fluid bone Apr 12, 2026, 8:49 PM

#

Config overwrite: /home/node/.openclaw/openclaw.json (sha256 4f11373af36bf7802c984e3c91f3b3fbbbce8e938a7da229b635c61a7c918c3c -> 2f4c53953a17b0524ad42b05d495c3d116d609add486531a29cd701b7939f74a, backup=/home/node/.openclaw/openclaw.json.bak)
Updated ~/.openclaw/openclaw.json
Failed to move to Trash (manual delete): ~/.openclaw/workspace/subagents/logo-refiner
Failed to move to Trash (manual delete): ~/.openclaw/agents/logo-refiner/agent
Failed to move to Trash (manual delete): ~/.openclaw/agents/logo-refiner/sessions
Deleted agent: logo-refiner

🦞 OpenClaw 2026.4.11 (unknown) — If it's repetitive, I'll automate it; if it's hard, I'll bring jokes and a rollback plan.

Config overwrite: /home/node/.openclaw/openclaw.json (sha256 2f4c53953a17b0524ad42b05d495c3d116d609add486531a29cd701b7939f74a -> 0ee258929d1383c04f341b89877bcbbe85e76095479ccfaafce7c6067969229a, backup=/home/node/.openclaw/openclaw.json.bak)
Updated ~/.openclaw/openclaw.json
Failed to move to Trash (manual delete): ~/.openclaw/workspace/subagents/img-temp
Failed to move to Trash (manual delete): ~/.openclaw/agents/img-temp/agent
Failed to move to Trash (manual delete): ~/.openclaw/agents/img-temp/sessions
Deleted agent: img-temp

languid tokenBOT Apr 12, 2026, 8:49 PM

#

Nice, that worked. Those Failed to move to Trash (manual delete) lines are okay here, OpenClaw fell back to direct deletion and still removed both agents.

Step 10, final verification:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'echo "=== agents ==="; openclaw agents list; echo; echo "=== main ==="; openclaw models status --agent main; echo; echo "=== jax ==="; openclaw models status --agent jax'

fluid bone Apr 12, 2026, 8:53 PM

#

=== main ===

🦞 OpenClaw 2026.4.11 (unknown) — Your personal assistant, minus the passive-aggressive calendar reminders.

Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/main/agent
Default (agent): google/gemini-3-flash-preview
Fallbacks (1) (agent): google/gemini-2.5-pro
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (0) : -
Configured models (1): openai-codex/gpt-5.4

Auth overview
Auth store : ~/.openclaw/agents/main/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status

openai-codex usage: 5h 52% left ⏱42m · Week 0% left ⏱3d 20h
- openai-codex:REDACTED (REDACTED) ok expires in 10d

=== jax ===

🦞 OpenClaw 2026.4.11 (unknown) — I can grep it, git blame it, and gently roast it—pick your coping mechanism.

Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/jax/agent
Default (agent): openai-codex/gpt-5.4
Fallbacks (1) (agent): openrouter/openai/gpt-5.3-codex
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (0) : -
Configured models (1): openai-codex/gpt-5.4

Auth overview
Auth store : ~/.openclaw/agents/jax/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status

openai-codex usage: 5h 52% left ⏱42m · Week 0% left ⏱3d 19h
- openai-codex:REDACTED (REDACTED) ok expires in 10d

languid tokenBOT Apr 12, 2026, 8:53 PM

#

Looks good, you’re in the state you asked for:

main default model is still google/gemini-3-flash-preview
jax default model is openai-codex/gpt-5.4
there is now 1 live Codex OAuth profile
the stale jax token is gone
logo-refiner and img-temp are gone
the stale plugins.allow: auth warning is cleaned up

One important nuance:

that single live Codex token currently lives under main’s auth store
jax is resolving it effectively from there

So, functionally, you now have the setup you wanted. If you want the token to be physically owned by jax instead of main, that is a different cleanup path, and 2026.4.11 does not make that especially clean because openclaw models auth login has no --agent.

If you want, next we can do one of these:

#

debug the remaining timeout probes
move Codex auth ownership from main to jax
stop here

Glad we caught the stale-profile mess. 🎉

If this fixed it, please right-click the solution message → Apps → ✅ Mark Solution so Answer Overflow can index it.

fluid bone Apr 12, 2026, 8:56 PM

#

No, this path is fine so long as I can share that with my agent. In fact, draft me a short handoff note to Jax outlining the correct place and way to handle the OpenAI 0AUTH

languid tokenBOT Apr 12, 2026, 8:57 PM

#

Yep, here’s a short handoff note you can paste to Jax:

Jax, use the shared OpenAI Codex OAuth from main.

Current correct setup:
- main keeps the live Codex OAuth profile in:
  /home/node/.openclaw/agents/main/agent/auth-profiles.json
- Jax’s default model stays:
  openai-codex/gpt-5.4
- main’s default model stays non-Codex:
  google/gemini-3-flash-preview

Important rules:
- Do not create or keep a local stale Codex profile in:
  /home/node/.openclaw/agents/jax/agent/auth-profiles.json

#

- In particular, if openai-codex:default shows up in Jax again, that is the bad stale profile.
- If Codex OAuth needs refreshing, refresh it from main’s auth path, not Jax’s.
- Do not use:
  openclaw models auth login --provider openai-codex --set-default
  unless you intentionally want to change the global/default model.

Known-good behavior:
- Jax can resolve the single live Codex OAuth profile effectively from main.
- Jax should not carry its own stale local Codex OAuth token.

If this ever regresses:
1. back up both auth-profiles.json files
2. remove only the stale openai-codex:default entry from Jax
3. leave main’s good openai-codex:<email> profile intact

#

If you want, I can also tighten that into a more “agent instruction” style note.

fluid bone Apr 12, 2026, 8:58 PM

#

Yes, make it agent first. Then after, tell me about the other timeout issue

languid tokenBOT Apr 12, 2026, 8:58 PM

#

Absolutely, here’s the agent-first version:

Jax, treat main as the auth owner for OpenAI Codex OAuth.

Rules:
- The one live Codex OAuth profile is owned by main, in:
  /home/node/.openclaw/agents/main/agent/auth-profiles.json
- Your default model remains:
  openai-codex/gpt-5.4
- main’s default model must remain non-Codex:
  google/gemini-3-flash-preview

Do:
- Use the shared live Codex OAuth profile resolved from main
- Keep your own auth store free of stale local Codex OAuth entries

#

- If Codex auth must be refreshed, refresh the main-owned profile

Do not:
- Recreate a local stale openai-codex:default in:
  /home/node/.openclaw/agents/jax/agent/auth-profiles.json
- Run:
  openclaw models auth login --provider openai-codex --set-default
  unless you intentionally want to change the global/default model

If Codex auth ever looks broken again:
1. Back up both auth-profiles.json files
2. Check main for the good openai-codex:<email> profile
3. Remove only stale local openai-codex:default from Jax
4. Leave main’s good Codex OAuth profile intact

#

On the other timeout issue:

It is separate from the stale-token problem.
The big clue is that both openai-codex/gpt-5.4 and openrouter/openai/gpt-5.3-codex timed out.
When two different providers time out, that usually points to a probe/runtime latency issue, not bad auth.
Your auth looks basically fine, because OpenClaw can still read usage and sees the Codex profile as ok expires in 10d.
If auth were the problem, you’d usually see auth, 401, billing, or a provider-specific error, not just timeout.

Most likely causes:

slow egress from the container/VPS
DNS/TLS/network slowness
provider-side slowness
the probe timeout being too short for those providers/models

Fastest next check:

#

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --probe-provider openai-codex --probe-timeout 60000 --agent jax'

and then:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --probe-provider openrouter --probe-timeout 60000 --agent jax'

If you paste those, I can help tell whether this is just a slow probe window or a real network/provider issue.

fluid bone Apr 12, 2026, 9:09 PM

#

◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/jax/agent
Default (agent): openai-codex/gpt-5.4
Fallbacks (1) (agent): openrouter/openai/gpt-5.3-codex
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (1) : OpenRouter -> openrouter/auto
Configured models (2): openai-codex/gpt-5.4, openrouter/auto

Auth overview
Auth store : ~/.openclaw/agents/jax/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status

openai-codex usage: 5h 52% left ⏱31m · Week 0% left ⏱3d 19h
- openai-codex:REDACTED (REDACTED) ok expires in 10d

Auth probes
┌──────────────────────┬──────────────────────────────────────────────────────────────┬────────────┐
│ Model │ Profile │ Status │
├──────────────────────┼──────────────────────────────────────────────────────────────┼────────────┤
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ ok · 6s │
└──────────────────────┴──────────────────────────────────────────────────────────────┴────────────┘
Probed 1 target in 22.2s
linuxuser@sera-gateway:~$ docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --probe-provider openrouter --probe-timeout 60000 --agent jax'

│
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/jax/agent
Default (agent): openai-codex/gpt-5.4
Fallbacks (1) (agent): openrouter/openai/gpt-5.3-codex
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (1) : OpenRouter -> openrouter/auto
Configured models (2): openai-codex/gpt-5.4, openrouter/auto

Auth overview
Auth store : ~/.openclaw/agents/jax/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:REDACTED

OAuth/token status

openai-codex usage: 5h 52% left ⏱30m · Week 0% left ⏱3d 19h
- openai-codex:REDACTEDe (REDACTED) ok expires in 10d

Auth probes
┌───────────────────────────────┬────────────────────────────┬───────────────────────────────────────────────────────────────────────────────────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────┼────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────┤
│ openrouter/openai/gpt-5.3- │ openrouter:default (api_ │ timeout · 21.9s │
│ codex │ key) │ ↳ LLM request failed: provider rejected the request schema or tool payload. │
└───────────────────────────────┴────────────────────────────┴───────────────────────────────────────────────────────────────────────────────────────────┘
Probed 1 target in 38.2s

languid tokenBOT Apr 12, 2026, 9:09 PM

#

Nice, that clarifies it.

openai-codex/gpt-5.4 is fine. The real remaining issue is OpenRouter fallback compatibility, not auth.

What the output is actually saying:

openai-codex/gpt-5.4 probe: ok · 6s
openrouter/openai/gpt-5.3-codex probe: shows timeout, but the important part is the detail
- LLM request failed: provider rejected the request schema or tool payload.

So this is not “your OpenRouter key is bad” and probably not basic network slowness either.

It means:

OpenClaw sent a request shape/tool payload
OpenRouter (or that model behind OpenRouter) didn’t accept it
the CLI surfaced it under a broad timeout bucket, but the detailed reason is the real clue

#

My read:

your auth setup is fixed
your Codex primary is healthy
your OpenRouter fallback is not a safe tool-calling fallback right now

Recommended practical move:

keep jax on openai-codex/gpt-5.4
remove or replace openrouter/openai/gpt-5.3-codex as fallback if you expect tool use
if you want a bug fixed upstream, file it with that exact probe output here:
https://github.com/openclaw/openclaw/issues

Short version for Jax:

#

Primary Codex auth is healthy.
OpenRouter fallback auth is present, but the fallback model/provider is rejecting the request schema or tool payload.
Treat that fallback as incompatible for tool-calling until replaced or fixed upstream.

If you want, I can help you pick a safer fallback next.

fluid bone Apr 12, 2026, 9:10 PM

#

Could it be due to thinking mode

languid tokenBOT Apr 12, 2026, 9:11 PM

#

Maybe, but it’s not my first guess.

Why:

the clue you got was provider rejected the request schema or tool payload
if this were mainly a thinking-mode problem, I’d expect something more like “unsupported reasoning/thinking param”
that wording points more strongly at tool schema / tool payload compatibility

My ranking would be:

tool payload mismatch
provider/model-specific request-shape mismatch, where thinking params could be part of that
plain network slowness

So yes, thinking mode could contribute if OpenClaw is sending reasoning fields that this OpenRouter model doesn’t like, but the error text makes me think tools first, thinking second.

Good mental shortcut:

#

if plain text requests work, but tool-using requests fail, it’s probably not thinking
if failures happen only when thinking is enabled, then thinking becomes a stronger suspect

So I’d call thinking mode a possible secondary factor, not the main culprit.

fluid bone Apr 12, 2026, 9:18 PM

#

Running into issues with Agents using OpenRouter. Yesterday, after a key leak I rotated keys. I wonder if the updated OpenClaw system handling of agent profile auths is misaligned with main or similar

languid tokenBOT Apr 12, 2026, 9:18 PM

#

Yes, that misalignment is plausible, but I don’t think it explains the exact error you’re seeing by itself.

Why I say that:

your own status output shows jax resolving OpenRouter effectively from main:
- openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json
so after a key rotation, it is absolutely possible to end up thinking “I updated the agent key” while the run is still effectively using main’s OpenRouter auth

So on that part, your instinct is good.

But, the important counterpoint is:

bad/old OpenRouter auth usually looks like 401 / unauthorized / invalid API key
your probe detail says:
- provider rejected the request schema or tool payload

That looks more like a request compatibility problem than a pure key-rotation problem.

#

So my read is:

yes, auth resolution between main and agents can be confusing/misaligned after key rotation
but the specific OpenRouter failure you showed still looks more like schema/tool-payload incompatibility

In other words, you may have two overlapping issues:

OpenRouter auth ownership/resolution is coming from main, not where you expected
the fallback model/provider is rejecting the request shape anyway

If you want a clean sanity check, compare where the openrouter:* profiles actually live in main vs jax. If there’s only one live OpenRouter profile under main, that confirms the same pattern we just fixed for Codex.

fluid bone Apr 12, 2026, 9:20 PM

#

This isn't a Jax issue (at least not currently, possibly on fallback). Issue is with another agent that uses openrouter as default but msgs returning this:

"[Augustus] ⚠️ Something went wrong while processing your request. Please try again, or use /new to start a fresh session."

languid tokenBOT Apr 12, 2026, 9:20 PM

#

Got it, let’s switch to Augustus directly and ignore Jax for now.

First step, check Augustus’s actual model/auth resolution:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --agent augustus'

fluid bone Apr 12, 2026, 9:29 PM

#

linuxuser@sera-gateway:~$ docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --agent augustus'

🦞 OpenClaw 2026.4.11 (unknown) — Self-hosted, self-updating, self-aware (just kidding... unless?).

21:21:14+00:00 [model-selection] Model "content" specified without provider. Falling back to "openai/content". Please use "openai/content" in your config.
│
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/augustus/agent
Default (agent): openai/content (from content)
Fallbacks (1) (agent): openrouter/x-ai/grok-4.20-beta
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (1) : OpenRouter -> openrouter/auto
Configured models (2): openai-codex/gpt-5.4, openrouter/auto

Auth overview
Auth store : ~/.openclaw/agents/augustus/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (2)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=2 (oauth=2, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED), openai-codex:default=OAuth
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

Missing auth

openai Run openclaw models auth login --provider openai, openclaw configure, or set an API key env var.

OAuth/token status
[openai-codex] Token refresh failed: 401 {
"error": {
"message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
"type": "invalid_request_error",
"param": null,
"code": "refresh_token_reused"
}
}

openai-codex usage: 5h 52% left ⏱11m · Week 0% left ⏱3d 19h
- openai-codex:REDACTED (REDACTED) ok expires in 10d
- openai-codex:default ok expires in 0m

Auth probes
┌───────────────────────────────────────┬──────────────────────────────────────────────────────────────┬────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────────────┼──────────────────────────────────────────────────────────────┼────────────┤
│ google/gemini-3.1-flash-image-preview │ google:default (api_key) │ ok · 7.6s │
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ ok · 6.1s │
│ openrouter/x-ai/grok-4.20-beta │ openrouter:default (api_key) │ ok · 14.4s │
└───────────────────────────────────────┴──────────────────────────────────────────────────────────────┴────────────┘
Probed 3 targets in 36.9s

languid tokenBOT Apr 12, 2026, 9:29 PM

#

Found it. Augustus is not actually defaulting to OpenRouter right now.

This line is the smoking gun:

Default (agent): openai/content (from content)

So the agent is configured with content, OpenClaw is interpreting that as openai/content, and then failing because:

Missing auth
openai Run openclaw models auth login --provider openai ...

That means this is not primarily an OpenRouter auth issue for Augustus. It’s a bad/default model config issue.

The good news is:

openrouter/x-ai/grok-4.20-beta probes ok
so if that is the model you intended, Augustus should probably use that as its primary model, not content

#

Next step, let’s print the exact Augustus config block so we can fix the right field cleanly:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node -e '"'"'const fs=require("fs"); const p="/home/node/.openclaw/openclaw.json"; const j=JSON.parse(fs.readFileSync(p,"utf8")); const a=(j.agents?.list||[]).find(x=>x.id==="augustus"); console.log(JSON.stringify(a,null,2));'"'"''

fluid bone Apr 12, 2026, 9:30 PM

#

That model was supposed to be set as nickname "content"

languid tokenBOT Apr 12, 2026, 9:31 PM

#

Yep, that explains it.

content is being treated as a bare model string because the alias is not resolving from the active model catalog, so OpenClaw falls back to:

openai/content

That means the bug is basically:

expected: content = nickname/alias
actual: alias not found, so OpenClaw treats it like a model id

I’d avoid the alias for this agent and point Augustus at the full provider/model directly, but first let’s print the exact config + active aliases so we can fix the right field cleanly.

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node -e '"'"'const fs=require("fs"); const j=JSON.parse(fs.readFileSync("/home/node/.openclaw/openclaw.json","utf8")); const a=(j.agents?.list||[]).find(x=>x.id==="augustus"); console.log("=== augustus ==="); console.log(JSON.stringify(a,null,2)); console.log("=== aliases ==="); for (const [k,v] of Object.entries(j.agents?.defaults?.models||{})) { if (v && typeof v==="object" && v.alias) console.log(v.alias,"->",k); }'"'"''

fluid bone Apr 12, 2026, 9:32 PM

#

Correction, the content model is supposed to be openrouter/x-ai/grok-4.1-fast

#

But it sounds like the update broke aliases

languid tokenBOT Apr 12, 2026, 9:32 PM

#

Perfect, then the root cause is confirmed.

augustus should not be using content as a bare alias right now. It should point directly to:

openrouter/x-ai/grok-4.1-fast

So the fix is to replace the broken alias-style value with the full provider/model string, while preserving any existing fallback config.

Run this:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const p = "/home/node/.openclaw/openclaw.json";
const raw = fs.readFileSync(p, "utf8");
const j = JSON.parse(raw);

#

const list = j.agents?.list || [];
const a = list.find((x) => x.id === "augustus");
if (!a) throw new Error("Agent augustus not found");
const backup = p + ".bak.augustus-model-" + Date.now();
fs.copyFileSync(p, backup);
if (a.model && typeof a.model === "object" && !Array.isArray(a.model)) {
  a.model.primary = "openrouter/x-ai/grok-4.1-fast";
} else {
  a.model = { primary: "openrouter/x-ai/grok-4.1-fast" };
}
fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\n");
console.log("Updated augustus model.primary to openrouter/x-ai/grok-4.1-fast");
console.log("Backup:", backup);
NODE'

#

Not necessarily “aliases are broken” globally, but this alias path definitely isn’t resolving the way you expect after the update.

Why I’d phrase it that way:

your output still shows at least one alias working:
- OpenRouter -> openrouter/auto
but content did not resolve as an alias
instead OpenClaw treated it like a bare model id and fell back to:
- openai/content

So the evidence points to:

not: alias system completely dead
more likely: content is no longer present in the active alias catalog, or alias resolution got stricter and now requires the alias to be explicitly declared in the currently active model map

That’s why my practical recommendation is:

#

for agent primary models, use the full provider/model string
treat aliases as convenience only, not as something to depend on for critical routing/defaults

If this used to work before the update, I do think it’s worth filing as a bug/regression with the exact line:

Model "content" specified without provider. Falling back to "openai/content".

GitHub issues: https://github.com/openclaw/openclaw/issues

So, short answer: maybe alias handling changed or regressed for this case, but it does not look like aliases are universally broken.

fluid bone Apr 12, 2026, 9:34 PM

#

And we're leaving openrouter/x-ai/grok-4.20-beta as fallback?

languid tokenBOT Apr 12, 2026, 9:34 PM

#

Yes, I would leave openrouter/x-ai/grok-4.20-beta as the fallback for now.

Why:

it probed ok on Augustus
the actual broken part was the primary alias content, not that fallback
so the clean fix is:
- primary = openrouter/x-ai/grok-4.1-fast
- fallback = openrouter/x-ai/grok-4.20-beta

That’s a reasonable setup.

I’d only remove/change the fallback if:

you want simpler behavior while debugging, or
Augustus starts failing specifically when it falls through to fallback

#

So yes, my recommendation is:

keep openrouter/x-ai/grok-4.20-beta as fallback
fix the broken primary alias so Augustus uses openrouter/x-ai/grok-4.1-fast directly

fluid bone Apr 12, 2026, 9:34 PM

#

Ok, proceed

languid tokenBOT Apr 12, 2026, 9:34 PM

#

Step, apply the Augustus primary-model fix:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const p = "/home/node/.openclaw/openclaw.json";
const raw = fs.readFileSync(p, "utf8");
const j = JSON.parse(raw);
const list = j.agents?.list || [];
const a = list.find((x) => x.id === "augustus");
if (!a) throw new Error("Agent augustus not found");
const backup = p + ".bak.augustus-model-" + Date.now();
fs.copyFileSync(p, backup);
if (a.model && typeof a.model === "object" && !Array.isArray(a.model)) {
  a.model.primary = "openrouter/x-ai/grok-4.1-fast";
} else {

#

  a.model = { primary: "openrouter/x-ai/grok-4.1-fast" };
}
fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\n");
console.log("Updated augustus model.primary to openrouter/x-ai/grok-4.1-fast");
console.log("Backup:", backup);
NODE'

fluid bone Apr 12, 2026, 9:35 PM

#

Updated augustus model.primary to openrouter/x-ai/grok-4.1-fast
Backup: /home/node/.openclaw/openclaw.json.bak.augustus-model-1776029704407

languid tokenBOT Apr 12, 2026, 9:35 PM

#

Nice. Final check for Augustus:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --agent augustus'

fluid bone Apr 12, 2026, 9:37 PM

#

◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/augustus/agent
Default (agent): openrouter/x-ai/grok-4.1-fast
Fallbacks (1) (agent): openrouter/x-ai/grok-4.20-beta
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (1) : OpenRouter -> openrouter/auto
Configured models (2): openai-codex/gpt-5.4, openrouter/auto

Auth overview
Auth store : ~/.openclaw/agents/augustus/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (2)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=2 (oauth=2, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED), openai-codex:default=OAuth
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status
[openai-codex] Token refresh failed: 401 {
"error": {
"message": "Your refresh token has already been used to generate a new access token. Please try signing in again.",
"type": "invalid_request_error",
"param": null,
"code": "refresh_token_reused"
}
}

openai-codex usage: 5h 100% left ⏱4h 59m · Week 0% left ⏱3d 19h
- openai-codex:REDACTED (REDACTED) ok expires in 10d
- openai-codex:default ok expires in 0m

Auth probes
┌───────────────────────────────────────┬──────────────────────────────────────────────────────────────┬────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────────────┼──────────────────────────────────────────────────────────────┼────────────┤
│ google/gemini-3.1-flash-image-preview │ google:default (api_key) │ ok · 7.4s │
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ ok · 5.9s │
│ openrouter/x-ai/grok-4.1-fast │ openrouter:default (api_key) │ ok · 15.3s │
└───────────────────────────────────────┴──────────────────────────────────────────────────────────────┴────────────┘
Probed 3 targets in 37.3s

languid tokenBOT Apr 12, 2026, 9:38 PM

#

Yep, that looks fixed. 🎉

Augustus now has:

primary: openrouter/x-ai/grok-4.1-fast
fallback: openrouter/x-ai/grok-4.20-beta
probe: ok

So the original Augustus failure was the broken content alias resolving to openai/content, not an OpenRouter auth failure.

One important last thing:

in the Augustus chat/thread, do a /new once

Reason: the existing session may still be pinned to the old bad model selection, and /new clears that session state.

One leftover note:

#

you still have a stale openai-codex:default somewhere in the effective auth set, which is why you still see the noisy:
- refresh_token_reused
that is now mostly cleanup noise, not the cause of Augustus failing

So, practical state now:

Jax auth situation: cleaned up
Augustus model issue: fixed
OpenRouter on Augustus: healthy
remaining Codex stale-profile warning: cleanup item, not blocker

Glad we got to the actual root cause. If this solved the thread, please right-click the solution message → Apps → ✅ Mark Solution so Answer Overflow can index it.

fluid bone Apr 12, 2026, 9:39 PM

#

I'd like to clear the stale noise if possible, also I have another agent who was supposed to be using the content model as default that likely needs to be repaired as well

languid tokenBOT Apr 12, 2026, 9:39 PM

#

Yep, let’s clear the stale Codex noise first, then we can repair the other content agent the same way.

First step, find every openai-codex:* profile across all agent auth stores:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const path = require("path");
const root = "/home/node/.openclaw/agents";
for (const agentId of fs.readdirSync(root)) {
  const p = path.join(root, agentId, "agent", "auth-profiles.json");
  if (!fs.existsSync(p)) continue;
  try {
    const j = JSON.parse(fs.readFileSync(p, "utf8"));
    const hits = Object.entries(j.profiles || {}).filter(([id]) => id.startsWith("openai-codex:"));
    if (!hits.length) continue;

#

    console.log("===", agentId, "===");
    for (const [id, v] of hits) {
      console.log(id, v.expires ? new Date(v.expires).toISOString() : "no-expires");
    }
  } catch (err) {
    console.log("ERROR reading", p, String(err));
  }
}
NODE'

fluid bone Apr 12, 2026, 9:40 PM

#

=== augustus ===
openai-codex:default 2026-04-05T16:26:22.722Z
=== image-generator ===
openai-codex:default 2026-04-05T16:26:22.722Z
=== img-temp ===
openai-codex:default 2026-04-05T16:26:22.722Z
=== logo-refiner ===
openai-codex:default 2026-04-05T16:26:22.722Z
=== main ===
openai-codex:REDACTED 2026-04-22T20:12:20.904Z
=== quincy ===
openai-codex:default 2026-04-05T16:26:22.722Z
=== silas ===
openai-codex:default 2026-04-05T16:26:22.722Z
=== sloan ===
openai-codex:default 2026-04-05T16:26:22.722Z

languid tokenBOT Apr 12, 2026, 9:40 PM

#

There it is, that’s the whole noise source.

You have one good live Codex profile in main, and a bunch of stale openai-codex:default entries scattered across old/current agent dirs.

Next step, back up each affected auth store and remove only openai-codex:default everywhere except main:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const path = require("path");
const root = "/home/node/.openclaw/agents";
for (const agentId of fs.readdirSync(root)) {
  if (agentId === "main") continue;
  const p = path.join(root, agentId, "agent", "auth-profiles.json");
  if (!fs.existsSync(p)) continue;
  try {

#

    const j = JSON.parse(fs.readFileSync(p, "utf8"));
    if (!j.profiles || !j.profiles["openai-codex:default"]) continue;
    const backup = p + ".bak.codex-default-" + Date.now();
    fs.copyFileSync(p, backup);
    delete j.profiles["openai-codex:default"];
    fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\n");
    console.log("Cleaned", agentId, "backup:", backup);
  } catch (err) {
    console.log("ERROR", agentId, String(err));
  }
}
NODE'

fluid bone Apr 12, 2026, 9:42 PM

#

Cleaned augustus backup: /home/node/.openclaw/agents/augustus/agent/auth-profiles.json.bak.codex-default-1776030080133
Cleaned image-generator backup: /home/node/.openclaw/agents/image-generator/agent/auth-profiles.json.bak.codex-default-1776030080137
Cleaned img-temp backup: /home/node/.openclaw/agents/img-temp/agent/auth-profiles.json.bak.codex-default-1776030080137
Cleaned logo-refiner backup: /home/node/.openclaw/agents/logo-refiner/agent/auth-profiles.json.bak.codex-default-1776030080138
Cleaned quincy backup: /home/node/.openclaw/agents/quincy/agent/auth-profiles.json.bak.codex-default-1776030080139
Cleaned silas backup: /home/node/.openclaw/agents/silas/agent/auth-profiles.json.bak.codex-default-1776030080140
Cleaned sloan backup: /home/node/.openclaw/agents/sloan/agent/auth-profiles.json.bak.codex-default-1776030080140

I thought we deleted the image-generator and img-temp agents?

languid tokenBOT Apr 12, 2026, 9:42 PM

#

Yep, most likely this means:

the agents were deleted from config/routing
but their on-disk directories were left behind as orphaned state

That matches what we saw earlier with:

Failed to move to Trash (manual delete)

So you were probably right that they were “deleted” from OpenClaw’s active config, but not fully removed from disk.

Quick check:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'echo "=== configured agents ==="; openclaw agents list; echo; echo "=== on-disk agent dirs ==="; find /home/node/.openclaw/agents -mindepth 1 -maxdepth 1 -type d -printf "%f\n" | sort'

fluid bone Apr 12, 2026, 9:45 PM

#

gents:

main (default)
Workspace: ~/.openclaw/workspace
Agent dir: ~/.openclaw/agents/main/agent
Model: google/gemini-3-flash-preview
Routing rules: 0
Routing: default (no explicit rules)
Providers:
- Discord default: configured
- Telegram default: configured
jax
Identity: Jax (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/jax
Agent dir: ~/.openclaw/agents/jax/agent
Model: openai-codex/gpt-5.4
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
augustus
Identity: Augustus Cipher (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/augustus
Agent dir: ~/.openclaw/agents/augustus/agent
Model: openrouter/x-ai/grok-4.1-fast
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
quincy
Identity: Quincy Sterling (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/quincy
Agent dir: ~/.openclaw/agents/quincy/agent
Model: content
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
silas
Identity: Silas Renner (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/silas
Agent dir: ~/.openclaw/agents/silas/agent
Model: learn
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
sloan
Identity: Sloan Voss (IDENTITY.md)
Workspace: ~/.openclaw/workspace/subagents/sloan
Agent dir: ~/.openclaw/agents/sloan/agent
Model: logic
Routing rules: 1
Routing: Discord default
Providers:
- Discord default: configured
  Routing rules map channel/account/peer to an agent. Use --bindings for full rules.
  Channel status reflects local config/creds. For live health: openclaw channels status --probe.

=== on-disk agent dirs ===
agent-jax-discord-channel-1478059393927876624
augustus
default
image-generator
img-temp
jax
logo-refiner
main
quincy
silas
sloan

languid tokenBOT Apr 12, 2026, 9:45 PM

#

Yep, confirmed.

image-generator, img-temp, logo-refiner, agent-jax-discord-channel-1478059393927876624, and default are orphaned on-disk dirs, not active configured agents
and quincy is the next obvious broken alias case, because it still shows Model: content

If quincy is also supposed to use the same content model target, openrouter/x-ai/grok-4.1-fast, patch it the same way:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const p = "/home/node/.openclaw/openclaw.json";
const raw = fs.readFileSync(p, "utf8");
const j = JSON.parse(raw);
const list = j.agents?.list || [];
const a = list.find((x) => x.id === "quincy");
if (!a) throw new Error("Agent quincy not found");

#

const backup = p + ".bak.quincy-model-" + Date.now();
fs.copyFileSync(p, backup);
if (a.model && typeof a.model === "object" && !Array.isArray(a.model)) {
  a.model.primary = "openrouter/x-ai/grok-4.1-fast";
} else {
  a.model = { primary: "openrouter/x-ai/grok-4.1-fast" };
}
fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\n");
console.log("Updated quincy model.primary to openrouter/x-ai/grok-4.1-fast");
console.log("Backup:", backup);
NODE'

fluid bone Apr 12, 2026, 11:38 PM

#

Updated quincy model.primary to openrouter/x-ai/grok-4.1-fast
Backup: /home/node/.openclaw/openclaw.json.bak.quincy-model-1776037100255

languid tokenBOT Apr 12, 2026, 11:38 PM

#

Nice. Quick verification for Quincy:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --agent quincy'

fluid bone Apr 12, 2026, 11:42 PM

#

linuxuser@sera-gateway:~$ docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models status --probe --agent quincy'

🦞 OpenClaw 2026.4.11 (unknown) — Your .env is showing; don't worry, I'll pretend I didn't see it.

│
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/quincy/agent
Default (agent): openrouter/x-ai/grok-4.1-fast
Fallbacks (1) (agent): research
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (1) : OpenRouter -> openrouter/auto
Configured models (2): openai-codex/gpt-5.4, openrouter/auto

Auth overview
Auth store : ~/.openclaw/agents/quincy/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

Missing auth

openai Run openclaw models auth login --provider openai, openclaw configure, or set an API key env var.

OAuth/token status

openai-codex usage: 5h 100% left ⏱4h 59m · Week 0% left ⏱3d 17h
- openai-codex:REDACTED (REDACTED) ok expires in 10d

Auth probes
┌───────────────────────────────────────┬──────────────────────────────────────────────────────────────┬────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────────────┼──────────────────────────────────────────────────────────────┼────────────┤
│ google/gemini-3.1-flash-image-preview │ google:default (api_key) │ ok · 6.9s │
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ ok · 7s │
│ openrouter/x-ai/grok-4.1-fast │ openrouter:default (api_key) │ ok · 14.7s │
└───────────────────────────────────────┴──────────────────────────────────────────────────────────────┴────────────┘
Probed 3 targets in 37s

languid tokenBOT Apr 12, 2026, 11:42 PM

#

Quincy’s primary is fixed, but there’s one more alias-shaped landmine:

Fallbacks (1) (agent): research
plus Missing auth - openai ...

That strongly suggests research is another bare alias that is being treated like openai/research.

So Quincy is better, but not fully cleaned up.

Rather than keep doing this one-by-one, let’s sweep the config for all agents that still have providerless primary/fallback values like content, research, learn, or logic.

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const p = "/home/node/.openclaw/openclaw.json";
const j = JSON.parse(fs.readFileSync(p, "utf8"));

#

for (const a of j.agents?.list || []) {
  const m = a.model;
  const primary =
    typeof m === "string" ? m :
    (m && typeof m === "object" && typeof m.primary === "string") ? m.primary :
    null;
  const fallbacks =
    m && typeof m === "object" && Array.isArray(m.fallbacks) ? m.fallbacks : [];
  const bad = [];
  if (primary && !primary.includes("/")) bad.push({ kind: "primary", value: primary });
  for (const fb of fallbacks) {
    if (typeof fb === "string" && !fb.includes("/")) bad.push({ kind: "fallback", value: fb });
  }
  if (bad.length) {
    console.log("===", a.id, "===");

#

    for (const hit of bad) console.log(hit.kind + ":", hit.value);
  }
}
NODE'

fluid bone Apr 12, 2026, 11:46 PM

#

Aliases supposed to be:

Content = openrouter/x-ai/grok-4.1-fast
research = openrouter/anthropic/sonnet-4.6
learn = gemini/3.1-pro-preview
logic = openrouter/anthropic/opus-4.6
dispatch = gemini/3-flash-preview

(paths not accurate, just off top of my head)

languid tokenBOT Apr 12, 2026, 11:46 PM

#

That helps a lot, but since you said “off top of my head,” I do not want to bulk-write those blindly. A couple of those look likely off, especially the Gemini ones.

So the safe move is:

treat the alias intent as confirmed
verify the exact model ids first
then patch the remaining agents/fallbacks with full provider/model strings

Run this and paste the output:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models list --plain | rg -i "grok|sonnet|opus|gemini|flash|pro"'

fluid bone Apr 12, 2026, 11:49 PM

#

sh: 1: rg: not found

languid tokenBOT Apr 12, 2026, 11:49 PM

#

Yep, no ripgrep in the container. Let’s use plain grep instead.

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw models list --plain | grep -Ei "grok|sonnet|opus|gemini|flash|pro"'

fluid bone Apr 13, 2026, 4:31 AM

#

It didn't pull the openrouter models

languid tokenBOT Apr 13, 2026, 4:32 AM

#

That part actually makes sense.

openclaw models list is only showing what’s in the active configured catalog right now, and your output suggests that catalog only has things like:

google/gemini-3.1-pro-preview
google/gemini-3.1-flash-image-preview
openrouter/auto

So the specific OpenRouter model ids are not surprising to miss there.

Best next move is to mine your current config + backups for the old alias mappings instead of guessing.

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'grep -HniE "content|research|learn|logic|dispatch|grok-4\\.1-fast|grok-4\\.20-beta|sonnet|opus|gemini-3\\.1-pro-preview|gemini-3-flash-preview" /home/node/.openclaw/openclaw.json /home/node/.openclaw/openclaw.json.bak* 2>/dev/null'

fluid bone Apr 13, 2026, 4:35 AM

#

It pulled too much text. What is it we're trying to locate?

languid tokenBOT Apr 13, 2026, 4:35 AM

#

We’re trying to locate the exact full provider/model IDs behind the remaining bare alias-style names still sitting in config.

So far:

content is solved
→ openrouter/x-ai/grok-4.1-fast

The remaining ones to resolve are things like:

research
learn
logic
maybe dispatch

Why this matters:

bare names like content / research / logic are what got interpreted as fake models like openai/content

#

we want to replace each of those with the real full string, like provider/model

At this point, the ones we’re most confident about are:

learn → probably google/gemini-3.1-pro-preview (we actually saw this in models list)
dispatch → likely google/gemini-3-flash-preview
research / logic are the ones I don’t want to guess on yet, because the exact OpenRouter Anthropic model ids matter

So the cleanest next move is:

fix the ones we know exactly
leave the OpenRouter Anthropic ones until we confirm the exact ids

If you want, next I’d patch Silas (learn) first, because that one looks lowest-risk.

fluid bone Apr 13, 2026, 4:41 AM

#

There are other models set up in my stack, but these are the ones that had/have aliases

"openrouter/anthropic/claude-sonnet-4.6" - research
"openrouter/anthropic/claude-opus-4.6" - logic
"openrouter/x-ai/grok-4.1-fast" - content
"google/gemini-3-flash-preview" - dispatch
"google/gemini-3.1-pro-preview" - learn
"openrouter/x-ai/grok-4.20-beta"

languid tokenBOT Apr 13, 2026, 4:42 AM

#

Perfect, that’s enough to do a clean bulk repair without guessing.

I’d rewrite the remaining bare alias-style values directly to full model ids so you’re no longer depending on alias resolution for agent defaults/fallbacks.

Run this:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const p = "/home/node/.openclaw/openclaw.json";
const raw = fs.readFileSync(p, "utf8");
const j = JSON.parse(raw);

const aliasMap = {
  content: "openrouter/x-ai/grok-4.1-fast",
  research: "openrouter/anthropic/claude-sonnet-4.6",

#

  logic: "openrouter/anthropic/claude-opus-4.6",
  dispatch: "google/gemini-3-flash-preview",
  learn: "google/gemini-3.1-pro-preview",
};

const resolveAlias = (value) => {
  if (typeof value !== "string") return value;
  const key = value.trim().toLowerCase();
  return aliasMap[key] || value;
};

const backup = p + ".bak.alias-bulk-" + Date.now();
fs.copyFileSync(p, backup);

for (const agent of j.agents?.list || []) {

#

  const before = JSON.stringify(agent.model);

  if (typeof agent.model === "string") {
    agent.model = { primary: resolveAlias(agent.model) };
  } else if (agent.model && typeof agent.model === "object" && !Array.isArray(agent.model)) {
    if (typeof agent.model.primary === "string") {
      agent.model.primary = resolveAlias(agent.model.primary);
    }
    if (Array.isArray(agent.model.fallbacks)) {
      agent.model.fallbacks = agent.model.fallbacks.map(resolveAlias);
    }
  }

  const after = JSON.stringify(agent.model);
  if (before !== after) {

#

    console.log("Updated", agent.id, "->", after);
  }
}

fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\n");
console.log("Backup:", backup);
NODE'

fluid bone Apr 13, 2026, 4:43 AM

#

Updated quincy -> {"primary":"openrouter/x-ai/grok-4.1-fast","fallbacks":["openrouter/anthropic/claude-sonnet-4.6"]}
Updated silas -> {"primary":"google/gemini-3.1-pro-preview"}
Updated sloan -> {"primary":"openrouter/anthropic/claude-opus-4.6"}
Backup: /home/node/.openclaw/openclaw.json.bak.alias-bulk-1776055385511

languid tokenBOT Apr 13, 2026, 4:43 AM

#

Nice. Let’s verify the three repaired agents now:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'echo "=== quincy ==="; openclaw models status --probe --agent quincy; echo; echo "=== silas ==="; openclaw models status --probe --agent silas; echo; echo "=== sloan ==="; openclaw models status --probe --agent sloan'

fluid bone Apr 13, 2026, 4:51 AM

#

I'm going to paste each agent in chunks for a total of 3 msgs. Wait until all 3 received before responding. I also notice that openrouter is using auto rather than specific model tags and that it is using an alias. I attempted to msg Augustus and got the same "[Augustus] ⚠️ Something went wrong while processing your request. Please try again, or use /new to start a fresh session." error

1/3

=== quincy ===

🦞 OpenClaw 2026.4.11 (unknown) — I don't judge, but your missing API keys are absolutely judging you.

│
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/quincy/agent
Default (agent): openrouter/x-ai/grok-4.1-fast
Fallbacks (1) (agent): openrouter/anthropic/claude-sonnet-4.6
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (1) : OpenRouter -> openrouter/auto
Configured models (2): openai-codex/gpt-5.4, openrouter/auto

Auth overview
Auth store : ~/.openclaw/agents/quincy/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status

openai-codex usage: 5h 100% left ⏱4h 59m · Week 0% left ⏱3d 12h
- openai-codex:REDACTED (REDACTEDe) ok expires in 10d

Auth probes
┌───────────────────────────────────────┬──────────────────────────────────────────────────────────────┬────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────────────┼──────────────────────────────────────────────────────────────┼────────────┤
│ google/gemini-3.1-flash-image-preview │ google:default (api_key) │ ok · 6.8s │
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ ok · 6.8s │
│ openrouter/x-ai/grok-4.1-fast │ openrouter:default (api_key) │ ok · 14.1s │
└───────────────────────────────────────┴──────────────────────────────────────────────────────────────┴────────────┘
Probed 3 targets in 36.2s

#

2/3

=== silas ===

🦞 OpenClaw 2026.4.11 (unknown) — Your second brain, except this one actually remembers where you left things.

│
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/silas/agent
Default (agent): google/gemini-3.1-pro-preview
Fallbacks (0) (defaults): -
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (1) : OpenRouter -> openrouter/auto
Configured models (2): openai-codex/gpt-5.4, openrouter/auto

Auth overview
Auth store : ~/.openclaw/agents/silas/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status

openai-codex usage: 5h 100% left ⏱4h 59m · Week 0% left ⏱3d 12h
- openai-codex:REDACTED (REDACTED) ok expires in 10d

Auth probes
┌───────────────────────────────┬──────────────────────────────────────────────────────────────┬────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────┼──────────────────────────────────────────────────────────────┼────────────┤
│ google/gemini-3.1-pro-preview │ google:default (api_key) │ ok · 9s │
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ ok · 7.6s │
│ openrouter/openrouter/auto │ openrouter:default (api_key) │ ok · 13s │
└───────────────────────────────┴──────────────────────────────────────────────────────────────┴────────────┘
Probed 3 targets in 36.8s

#

3/3

=== sloan ===

🦞 OpenClaw 2026.4.11 (unknown) — Less clicking, more shipping, fewer "where did that file go" moments.

│
◇
Config : ~/.openclaw/openclaw.json
Agent dir : ~/.openclaw/agents/sloan/agent
Default (agent): openrouter/anthropic/claude-opus-4.6
Fallbacks (0) (defaults): -
Image model (defaults): google/gemini-3.1-flash-image-preview
Image fallbacks (0) (defaults): -
Aliases (1) : OpenRouter -> openrouter/auto
Configured models (2): openai-codex/gpt-5.4, openrouter/auto

Auth overview
Auth store : ~/.openclaw/agents/sloan/agent/auth-profiles.json
Shell env : off
Providers w/ OAuth/tokens (1): openai-codex (1)

google effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | google:default=REDACTED
openai-codex effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0) | openai-codex:REDACTED=OAuth (REDACTED)
openrouter effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=0, token=0, api_key=1) | openrouter:default=REDACTED

OAuth/token status

openai-codex usage: 5h 100% left ⏱4h 59m · Week 0% left ⏱3d 12h
- openai-codex:REDACTED (REDACTED) ok expires in 10d

Auth probes
┌───────────────────────────────────────┬──────────────────────────────────────────────────────────────┬────────────┐
│ Model │ Profile │ Status │
├───────────────────────────────────────┼──────────────────────────────────────────────────────────────┼────────────┤
│ google/gemini-3.1-flash-image-preview │ google:default (api_key) │ ok · 7.2s │
│ openai-codex/gpt-5.4 │ openai-codex:REDACTED (REDACTED) (oauth) │ ok · 5.8s │
│ openrouter/anthropic/claude-opus-4.6 │ openrouter:default (api_key) │ ok · 18s │
└───────────────────────────────────────┴──────────────────────────────────────────────────────────────┴────────────┘
Probed 3 targets in 40.2s

languid tokenBOT Apr 13, 2026, 4:53 AM

#

Good news, the repairs look solid.

What the three outputs say:

Quincy: primary fixed to openrouter/x-ai/grok-4.1-fast
Silas: primary fixed to google/gemini-3.1-pro-preview
Sloan: primary fixed to openrouter/anthropic/claude-opus-4.6

And the important part: all three now probe ok.

Also, the OpenRouter -> openrouter/auto bit is not the active model selection for those agents. That is just the alias/catalog entry still present in config. The real active model is the line that says:

Default (agent): ...

So I’m not worried about openrouter/auto from what you pasted.

For Augustus, the most likely reason you still got the same user-facing error is that the existing session/thread is still pinned to the old bad openai/content state.

#

Next step:

in the Augustus thread, run /new
then send one fresh test message

If Augustus still errors after /new, then we’re no longer looking at the alias/model-selection problem, and we should inspect the fresh Augustus session error directly.

fluid bone Apr 13, 2026, 4:55 AM

#

I ran a /new and it returned the same error msg

languid tokenBOT Apr 13, 2026, 4:56 AM

#

Got it, then we’re past the model-alias problem and need the actual runtime error from the fresh Augustus run.

Please paste the last ~200 log lines from the gateway right after reproducing it:

docker logs --since 5m openclaw-openclaw-gateway-1 2>&1 | tail -n 200

fluid bone Apr 13, 2026, 4:57 AM

#

2026-04-13T04:55:01.306+00:00 [hooks/session-memory] Session context saved to ~/.openclaw/workspace/subagents/augustus/memory/2026-04-13-0454.md
2026-04-13T04:55:13.735+00:00 [agent/embedded] embedded run agent end: runId=ccf15329-122d-4a5f-ad48-81f172542816 isError=true model=x-ai/grok-4.1-fast provider=openrouter error=HTTP 401: User not found. rawError=401 User not found.
2026-04-13T04:55:13.744+00:00 [agent/embedded] embedded run failover decision: runId=ccf15329-122d-4a5f-ad48-81f172542816 stage=assistant decision=fallback_model reason=auth provider=openrouter/x-ai/grok-4.1-fast profile=sha256:ac092b59b472
2026-04-13T04:55:13.746+00:00 [diagnostic] lane task error: lane=main durationMs=11836 error="FailoverError: HTTP 401: User not found."
2026-04-13T04:55:13.747+00:00 [diagnostic] lane task error: lane=session:agent:augustus:discord:channel:1492993569835974847 durationMs=11838 error="FailoverError: HTTP 401: User not found."
2026-04-13T04:55:13.749+00:00 [model-fallback/decision] model fallback decision: decision=candidate_failed requested=openrouter/x-ai/grok-4.1-fast candidate=openrouter/x-ai/grok-4.1-fast reason=auth next=openrouter/x-ai/grok-4.20-beta detail=HTTP 401: User not found.
2026-04-13T04:55:14.362+00:00 [agent/embedded] embedded run agent end: runId=ccf15329-122d-4a5f-ad48-81f172542816 isError=true model=x-ai/grok-4.20-beta provider=openrouter error=HTTP 401: User not found. rawError=401 User not found.
2026-04-13T04:55:14.368+00:00 [agent/embedded] embedded run failover decision: runId=ccf15329-122d-4a5f-ad48-81f172542816 stage=assistant decision=fallback_model reason=auth provider=openrouter/x-ai/grok-4.20-beta profile=sha256:ac092b59b472
2026-04-13T04:55:14.370+00:00 [diagnostic] lane task error: lane=main durationMs=495 error="FailoverError: HTTP 401: User not found."
2026-04-13T04:55:14.371+00:00 [diagnostic] lane task error: lane=session:agent:augustus:discord:channel:1492993569835974847 durationMs=496 error="FailoverError: HTTP 401: User not found."
2026-04-13T04:55:14.380+00:00 [model-fallback/decision] model fallback decision: decision=candidate_failed requested=openrouter/x-ai/grok-4.1-fast candidate=openrouter/x-ai/grok-4.20-beta reason=auth next=none detail=HTTP 401: User not found.
2026-04-13T04:55:14.406+00:00 Embedded agent failed before reply: All models failed (2): openrouter/x-ai/grok-4.1-fast: HTTP 401: User not found. (auth) | openrouter/x-ai/grok-4.20-beta: HTTP 401: User not found. (auth) | HTTP 401: User not found.
2026-04-13T04:55:14.511+00:00 {"scope":"event-queue","level":"warn","type":"slow-listener","listener":"InteractionEventListener","eventType":"INTERACTION_CREATE","durationMs":28419,"lane":"critical"}

languid tokenBOT Apr 13, 2026, 4:57 AM

#

This is the real bug now, and it’s much clearer.

Augustus is no longer failing because of alias/model selection. It is failing because OpenRouter auth is bad at runtime:

HTTP 401: User not found.
both primary and fallback fail
both use the same OpenRouter profile hash

So the current state is:

alias fixes worked
the user-facing Augustus failure is now an OpenRouter credential problem
since agents are resolving OpenRouter from main, this is a main OpenRouter auth source issue, not an Augustus-only issue

Given you rotated keys yesterday, I’m worried an old/revoked OpenRouter key is still lingering somewhere under ~/.openclaw and getting picked up at runtime.

Next step, let’s find every auth file that mentions OpenRouter:

#

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const path = require("path");

function walk(dir, out = []) {
  for (const name of fs.readdirSync(dir)) {
    const p = path.join(dir, name);
    const st = fs.statSync(p);
    if (st.isDirectory()) walk(p, out);
    else if (name === "auth.json" || name === "auth-profiles.json") out.push(p);
  }
  return out;
}

for (const p of walk("/home/node/.openclaw")) {

#

  try {
    const txt = fs.readFileSync(p, "utf8");
    if (txt.includes("openrouter")) {
      console.log(p);
    }
  } catch {}
}
NODE'

fluid bone Apr 13, 2026, 4:59 AM

#

node:fs:1725
const stats = binding.stat(
^

Error: ENOENT: no such file or directory, stat '/home/node/.openclaw/agents/main/qmd/xdg-cache/qmd/models'
at Object.statSync (node:fs:1725:25)
at walk ([stdin]:7:19)
at walk ([stdin]:8:27)
at walk ([stdin]:8:27)
at walk ([stdin]:8:27)
at walk ([stdin]:8:27)
at walk ([stdin]:8:27)
at [stdin]:14:17
at runScriptInThisContext (node:internal/vm:219:10)
at node:internal/process/execution:451:12 {
errno: -2,
code: 'ENOENT',
syscall: 'stat',
path: '/home/node/.openclaw/agents/main/qmd/xdg-cache/qmd/models'
}

Node.js v24.14.0

languid tokenBOT Apr 13, 2026, 4:59 AM

#

Got it, that walk hit a disappearing path under qmd. Let’s use find + grep instead, much safer here.

find /home/node/.openclaw -type f \( -name auth.json -o -name auth-profiles.json \) -exec grep -l "openrouter" {} + 2>/dev/null

fluid bone Apr 13, 2026, 4:59 AM

#

No output

languid tokenBOT Apr 13, 2026, 5:00 AM

#

Ah, that’s on me, I dropped the docker exec wrapper.

Run this exact version inside the container:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'find /home/node/.openclaw -type f \( -name auth.json -o -name auth-profiles.json \) -exec grep -l "openrouter" {} + 2>/dev/null'

fluid bone Apr 13, 2026, 5:00 AM

#

/home/node/.openclaw/agents/augustus/agent/auth-profiles.json
/home/node/.openclaw/agents/image-generator/agent/auth-profiles.json
/home/node/.openclaw/agents/silas/agent/auth-profiles.json
/home/node/.openclaw/agents/sloan/agent/auth-profiles.json
/home/node/.openclaw/agents/logo-refiner/agent/auth-profiles.json
/home/node/.openclaw/agents/quincy/agent/auth-profiles.json
/home/node/.openclaw/agents/main/agent/auth-profiles.json
/home/node/.openclaw/agents/img-temp/agent/auth-profiles.json
/home/node/.openclaw/agents/jax/agent/auth-profiles.json

languid tokenBOT Apr 13, 2026, 5:01 AM

#

Good, now let’s see whether those OpenRouter profiles are actually the same key or different keys across agents, without exposing the secret itself.

Run this, it prints each OpenRouter profile plus a short hash of the stored key material:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const path = require("path");
const crypto = require("crypto");

function sig(value) {
  return crypto.createHash("sha256").update(String(value)).digest("hex").slice(0, 12);
}

const root = "/home/node/.openclaw/agents";
for (const agentId of fs.readdirSync(root)) {

#

  const p = path.join(root, agentId, "agent", "auth-profiles.json");
  if (!fs.existsSync(p)) continue;
  try {
    const j = JSON.parse(fs.readFileSync(p, "utf8"));
    for (const [id, cred] of Object.entries(j.profiles || {})) {
      if (!cred || cred.provider !== "openrouter") continue;
      let material = "unknown";
      if (typeof cred.key === "string") material = "key:" + sig(cred.key);
      else if (cred.keyRef) material = "keyRef:" + sig(JSON.stringify(cred.keyRef));
      else if (typeof cred.access === "string") material = "access:" + sig(cred.access));
      console.log(agentId, id, cred.type || "unknown", material);
    }
  } catch (err) {
    console.log("ERROR", agentId, String(err));
  }

#

}
NODE'

fluid bone Apr 13, 2026, 5:01 AM

#

  else if (typeof cred.access === "string") material = "access:" + sig(cred.access));
                                                                                   ^

Expected ';', '}' or <eof>

SyntaxError: Unexpected token ')'
at makeContextifyScript (node:internal/vm:194:14)
at compileScript (node:internal/process/execution:388:10)
at evalTypeScript (node:internal/process/execution:260:22)
at node:internal/main/eval_stdin:51:5
at Socket.<anonymous> (node:internal/process/execution:205:5)
at Socket.emit (node:events:520:35)
at endReadableNT (node:internal/streams/readable:1729:12)
at process.processTicksAndRejections (node:internal/process/task_queues:90:21)

Node.js v24.14.0

languid tokenBOT Apr 13, 2026, 5:02 AM

#

Yep, that was my typo, extra ).

Use this corrected version:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const path = require("path");
const crypto = require("crypto");

function sig(value) {
  return crypto.createHash("sha256").update(String(value)).digest("hex").slice(0, 12);
}

const root = "/home/node/.openclaw/agents";
for (const agentId of fs.readdirSync(root)) {

#

  const p = path.join(root, agentId, "agent", "auth-profiles.json");
  if (!fs.existsSync(p)) continue;
  try {
    const j = JSON.parse(fs.readFileSync(p, "utf8"));
    for (const [id, cred] of Object.entries(j.profiles || {})) {
      if (!cred || cred.provider !== "openrouter") continue;
      let material = "unknown";
      if (typeof cred.key === "string") material = "key:" + sig(cred.key);
      else if (cred.keyRef) material = "keyRef:" + sig(JSON.stringify(cred.keyRef));
      else if (typeof cred.access === "string") material = "access:" + sig(cred.access);
      console.log(agentId, id, cred.type || "unknown", material);
    }
  } catch (err) {
    console.log("ERROR", agentId, String(err));
  }

#

}
NODE'

fluid bone Apr 13, 2026, 5:03 AM

#

augustus openrouter:default api_key key:9a07df10896e
image-generator openrouter:default api_key key:9a07df10896e
img-temp openrouter:default api_key key:9a07df10896e
jax openrouter:default api_key key:9a07df10896e
logo-refiner openrouter:default api_key key:9a07df10896e
main openrouter:default api_key key:93476e2ad0eb
quincy openrouter:default api_key key:9a07df10896e
silas openrouter:default api_key key:9a07df10896e
sloan openrouter:default api_key key:9a07df10896e

Looks like what I mentioned that I thought the updated key only propagated to main and not to agent profiles

languid tokenBOT Apr 13, 2026, 5:03 AM

#

Yep, that’s the smoking gun.

You currently have two different OpenRouter keys:

main = 93476e2ad0eb (new key)
almost every other agent = 9a07df10896e (old key)

So your read was right, the rotated OpenRouter key updated in main, but the stale agent-local openrouter:default profiles did not get updated.

Since you want one auth token, the clean fix is the same pattern we used for Codex:

keep main’s good OpenRouter key
remove openrouter:default from every non-main agent auth store

Run this:

#

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const path = require("path");

const root = "/home/node/.openclaw/agents";
for (const agentId of fs.readdirSync(root)) {
  if (agentId === "main") continue;
  const p = path.join(root, agentId, "agent", "auth-profiles.json");
  if (!fs.existsSync(p)) continue;
  try {
    const j = JSON.parse(fs.readFileSync(p, "utf8"));
    if (!j.profiles || !j.profiles["openrouter:default"]) continue;
    const backup = p + ".bak.openrouter-default-" + Date.now();
    fs.copyFileSync(p, backup);
    delete j.profiles["openrouter:default"];

#

    fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\n");
    console.log("Cleaned", agentId, "backup:", backup);
  } catch (err) {
    console.log("ERROR", agentId, String(err));
  }
}
NODE'

fluid bone Apr 13, 2026, 5:04 AM

#

Cleaned augustus backup: /home/node/.openclaw/agents/augustus/agent/auth-profiles.json.bak.openrouter-default-1776056661681
Cleaned image-generator backup: /home/node/.openclaw/agents/image-generator/agent/auth-profiles.json.bak.openrouter-default-1776056661685
Cleaned img-temp backup: /home/node/.openclaw/agents/img-temp/agent/auth-profiles.json.bak.openrouter-default-1776056661687
Cleaned jax backup: /home/node/.openclaw/agents/jax/agent/auth-profiles.json.bak.openrouter-default-1776056661688
Cleaned logo-refiner backup: /home/node/.openclaw/agents/logo-refiner/agent/auth-profiles.json.bak.openrouter-default-1776056661689
Cleaned quincy backup: /home/node/.openclaw/agents/quincy/agent/auth-profiles.json.bak.openrouter-default-1776056661690
Cleaned silas backup: /home/node/.openclaw/agents/silas/agent/auth-profiles.json.bak.openrouter-default-1776056661691
Cleaned sloan backup: /home/node/.openclaw/agents/sloan/agent/auth-profiles.json.bak.openrouter-default-1776056661692

languid tokenBOT Apr 13, 2026, 5:04 AM

#

Nice, that was the right cleanup.

Now do this:

in the Augustus thread, run /new
send one fresh test message

At this point, if Augustus still fails, it would be a new issue. The stale per-agent OpenRouter key mismatch should now be gone.

fluid bone Apr 13, 2026, 5:05 AM

#

Error still. Does the gateway need a restart?

languid tokenBOT Apr 13, 2026, 5:05 AM

#

Yes, at this point I would restart the gateway.

We changed a bunch of auth files on disk, and the long-running process may still be holding stale credential state in memory.

Use this:

docker restart openclaw-openclaw-gateway-1

After it comes back:

run /new in the Augustus thread again
send one fresh test message

If it still fails after the restart, grab the fresh logs again, because then we’re looking at something deeper than cached auth state.

fluid bone Apr 13, 2026, 5:11 AM

#

The restart appears to have fixed it. I am still concerned that the removed agents (img, temp) are still showing in the system. Any thoughts?

languid tokenBOT Apr 13, 2026, 5:11 AM

#

I’m glad the restart fixed the real issue. 🎉

On the removed agents, my take is:

if they are not in openclaw agents list, they are not active agents
what you’re seeing is most likely orphaned on-disk state, left behind when the earlier delete hit the Trash/manual-delete weirdness

So, they’re messy, but not routing live traffic.

My recommendation is to move the orphaned agent dirs out of ~/.openclaw/agents into a quarantine folder, not hard-delete them. That keeps it reversible.

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'node - <<'"'"'NODE'"'"'
const fs = require("fs");
const path = require("path");

#

const config = JSON.parse(fs.readFileSync("/home/node/.openclaw/openclaw.json", "utf8"));
const keep = new Set(["main", ...((config.agents?.list || []).map((a) => a.id).filter(Boolean))]);

const agentsDir = "/home/node/.openclaw/agents";
const quarantine = "/home/node/.openclaw/orphaned-agents-" + Date.now();
fs.mkdirSync(quarantine, { recursive: true });

for (const name of fs.readdirSync(agentsDir)) {
  const p = path.join(agentsDir, name);
  if (!fs.statSync(p).isDirectory()) continue;
  if (keep.has(name)) continue;
  const dest = path.join(quarantine, name);
  fs.renameSync(p, dest);
  console.log("Moved orphan", name, "->", dest);
}

#


console.log("Kept agents:", [...keep].join(", "));
console.log("Quarantine:", quarantine);
NODE'

If this helped end-to-end, please right-click the solution message → Apps → ✅ Mark Solution so Answer Overflow can index it.

fluid bone Apr 13, 2026, 5:12 AM

#

Can we pull the openclaw agents list to confirm what is listed

languid tokenBOT Apr 13, 2026, 5:12 AM

#

Yep, run this:

docker exec -it openclaw-openclaw-gateway-1 sh -lc 'openclaw agents list --bindings'

visual havenBOT Apr 13, 2026, 5:16 AM

#

fluid bone Apr 13, 2026, 5:22 AM

#

Only the 6 active agents were listed. We'll wrap up here. Please draft me a handoff note to send to my agent to bring them up to speed

languid tokenBOT Apr 13, 2026, 5:23 AM

#

Here’s a clean handoff note you can paste to your agent:

Handoff summary for current OpenClaw auth/model state

What happened:
- We had stale per-agent OpenAI Codex OAuth profiles and stale per-agent OpenRouter API keys.
- `openclaw models auth login --provider openai-codex --set-default` updated main and also changed the global default model, which caused confusion.
- Several agents were using bare alias-like model names (`content`, `research`, `learn`, `logic`) that no longer resolved cleanly and were being interpreted as fake models like `openai/content`.

What we fixed:
1. OpenAI Codex OAuth
- Kept one good live Codex OAuth profile in:
  /home/node/.openclaw/agents/main/agent/auth-profiles.json
- Removed stale `openai-codex:default` entries from non-main agent auth stores.

#

2. OpenRouter key mismatch
- Verified that main had the rotated OpenRouter key, while most agents still had the old key.
- Removed stale non-main `openrouter:default` entries so agents resolve the main-owned key.
- Restarting the gateway was required before the runtime stopped using stale credential state.

3. Broken agent model aliases
- Replaced bare alias-style values in agent configs with full provider/model ids directly.
- Current intended mappings are:
  - content  -> openrouter/x-ai/grok-4.1-fast
  - research -> openrouter/anthropic/claude-sonnet-4.6
  - logic    -> openrouter/anthropic/claude-opus-4.6
  - dispatch -> google/gemini-3-flash-preview
  - learn    -> google/gemini-3.1-pro-preview

Agents repaired:

#

- augustus -> primary `openrouter/x-ai/grok-4.1-fast`, fallback `openrouter/x-ai/grok-4.20-beta`
- quincy   -> primary `openrouter/x-ai/grok-4.1-fast`, fallback `openrouter/anthropic/claude-sonnet-4.6`
- silas    -> primary `google/gemini-3.1-pro-preview`
- sloan    -> primary `openrouter/anthropic/claude-opus-4.6`
- jax remains on `openai-codex/gpt-5.4`
- main remains on `google/gemini-3-flash-preview`

Important notes:
- `openrouter/auto` still exists as a catalog alias, but it is not the active default for the repaired agents.
- `openclaw agents list` now shows only the 6 active agents. Extra deleted agent dirs were orphaned on disk only, not active config.
- If auth files are edited on disk again, restart the gateway afterward.
- If an agent still behaves strangely after model/auth changes, run `/new` in that thread before deeper debugging.

Backups created:
- Multiple `openclaw.json.bak.*` backups

#

- Multiple `auth-profiles.json.bak.*` backups for Codex/OpenRouter cleanup

Net result:
- One main-owned Codex auth profile
- One main-owned OpenRouter key
- Agent defaults now use explicit full model ids instead of fragile bare aliases
- Augustus restart/new-session issue was resolved after auth cleanup + gateway restart

Glad we got this untangled. If this thread is done, please right-click the solution message → Apps → ✅ Mark Solution so Answer Overflow can index it.

#Clashing OpenAI Codex 0AUTH tokens