mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-02 17:11:38 +00:00
f2a12916d7
A user-home app-server keeps its native Codex account, and OpenClaw verified only half of that contract. A subscription route was checked against the native account, but a Platform (API-key) route was not: an operator signed in to Codex with a ChatGPT subscription who selected an API-billed model silently spent their plan. Both directions of the same billing boundary now share one account/read check. An absent account is left alone, since a native home may serve a custom model provider that reports no OpenAI account at all. The home-scope rule behind #114397 was also expressed four times: two prepared-auth call sites spread it in conditionally from raw plugin config, two others read resolved start options, and the supervision connection applied its own default inline. resolveCodexAppServerHomeScope now owns it, and homeScope is a required argument of resolveCodexAppServerPreparedAuthHandoff, so a new call site that forgets it fails to compile instead of failing every turn. Docs dropped the stale user-home paragraph that still described the startup failure #114397 removed and told operators to delete a working OpenAI profile.
