traderclaw-cli 1.0.73 → 1.0.75

package/bin/installer-step-engine.mjs

@@ -1562,6 +1562,115 @@ function configureOpenClawLlmProvider({ provider, model, credential }, configPat
   return { configPath, provider, model };
 }
 
+/**
+ * Sets only `agents.defaults.model.primary` (OAuth / subscription paths where credentials live in OpenClaw auth profiles).
+ * Does not write API keys into config.env.
+ */
+function configureOpenClawLlmModelPrimaryOnly({ provider, model }, configPath = CONFIG_FILE) {
+  if (!provider || !model) {
+    throw new Error("LLM provider and model are required.");
+  }
+  if (!model.startsWith(`${provider}/`)) {
+    throw new Error(`Selected model '${model}' does not match provider '${provider}'.`);
+  }
+
+  let config = {};
+  try {
+    config = JSON.parse(readFileSync(configPath, "utf-8"));
+  } catch {
+    config = {};
+  }
+
+  if (!config.agents) config.agents = {};
+  if (!config.agents.defaults) config.agents.defaults = {};
+  ensureAgentsDefaultsSchemaCompat(config);
+  if (!config.agents.defaults.model || typeof config.agents.defaults.model !== "object") {
+    config.agents.defaults.model = {};
+  }
+  config.agents.defaults.model.primary = model;
+
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  return { configPath, provider, model };
+}
+
+/**
+ * Runs `openclaw models auth login --provider openai-codex` and feeds the pasted redirect URL or code on stdin
+ * when the CLI prompts (with a timed fallback for non-interactive / SSH).
+ */
+function runOpenClawCodexOAuthLogin(paste, emitLog) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("openclaw", ["models", "auth", "login", "--provider", "openai-codex"], {
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: false,
+    });
+
+    let stdout = "";
+    let stderr = "";
+    let pasteSent = false;
+
+    const sendPaste = () => {
+      if (pasteSent) return;
+      const p = String(paste || "").trim();
+      if (!p) return;
+      pasteSent = true;
+      try {
+        child.stdin.write(`${p}\n`);
+      } catch {
+        // ignore
+      }
+    };
+
+    let fallbackTimer = setTimeout(() => sendPaste(), 9000);
+
+    const onChunk = (chunk) => {
+      const combined = (stdout + stderr).toLowerCase();
+      const c = typeof chunk === "string" ? chunk : chunk.toString();
+      if (!pasteSent && /paste|authorization|redirect|callback/i.test(combined) && c.length > 0) {
+        clearTimeout(fallbackTimer);
+        fallbackTimer = setTimeout(() => sendPaste(), 400);
+      }
+    };
+
+    child.stdout?.on("data", (d) => {
+      const t = d.toString();
+      stdout += t;
+      const urls = extractUrls(t);
+      emitLog("info", t, urls);
+      onChunk(t);
+    });
+
+    child.stderr?.on("data", (d) => {
+      const t = d.toString();
+      stderr += t;
+      const urls = extractUrls(t);
+      emitLog("warn", t, urls);
+      onChunk(t);
+    });
+
+    child.on("close", (code) => {
+      clearTimeout(fallbackTimer);
+      if (code === 0) {
+        resolve({ stdout, stderr });
+        return;
+      }
+      const detail = `${stderr}\n${stdout}`.trim();
+      const err = new Error(
+        detail || `openclaw models auth login failed with exit code ${code}. Try running the same command in a normal shell, then re-run the wizard with "already logged in" checked.`,
+      );
+      err.code = code;
+      err.stdout = stdout;
+      err.stderr = stderr;
+      reject(err);
+    });
+
+    child.on("error", (e) => {
+      clearTimeout(fallbackTimer);
+      reject(e);
+    });
+  });
+}
+
 function verifyInstallation(modeConfig, apiKey) {
   const gatewayFile = join(CONFIG_DIR, "gateway", modeConfig.gatewayConfig);
   let llmConfigured = false;
@@ -1645,9 +1754,12 @@ export class InstallerStepEngine {
     this.modeConfig = modeConfig;
     this.options = {
       lane: normalizeLane(options.lane),
+      llmAuthMode: options.llmAuthMode === "oauth" ? "oauth" : "api_key",
       llmProvider: options.llmProvider || "",
       llmModel: options.llmModel || "",
       llmCredential: options.llmCredential || "",
+      llmOAuthPaste: typeof options.llmOAuthPaste === "string" ? options.llmOAuthPaste.trim() : "",
+      llmOAuthSkipLogin: options.llmOAuthSkipLogin === true,
       apiKey: options.apiKey || "",
       orchestratorUrl: options.orchestratorUrl || "https://api.traderclaw.ai",
       gatewayBaseUrl: options.gatewayBaseUrl || "",
@@ -1924,15 +2036,78 @@ export class InstallerStepEngine {
     const provider = String(this.options.llmProvider || "").trim();
     const requestedModel = String(this.options.llmModel || "").trim();
     const credential = String(this.options.llmCredential || "").trim();
-    if (!provider || !credential) {
+    const authMode = this.options.llmAuthMode === "oauth" ? "oauth" : "api_key";
+
+    if (!provider) {
       throw new Error(
-        "Missing required LLM settings. Select provider and provide credential in the wizard before starting installation.",
+        "Missing required LLM settings. Select provider in the wizard before starting installation.",
       );
     }
     if (!commandExists("openclaw")) {
       throw new Error("OpenClaw is not available yet. Install step must complete before LLM configuration.");
     }
 
+    if (authMode === "oauth") {
+      if (provider !== "openai-codex") {
+        throw new Error("OAuth mode requires LLM provider openai-codex (ChatGPT / Codex subscription).");
+      }
+      const skipLogin = this.options.llmOAuthSkipLogin === true;
+      const oauthPaste = String(this.options.llmOAuthPaste || "").trim();
+      if (!skipLogin && !oauthPaste) {
+        throw new Error(
+          "Codex OAuth requires a pasted authorization code or redirect URL, or enable skip if you already ran openclaw models auth login on this host.",
+        );
+      }
+      if (!skipLogin) {
+        try {
+          await runOpenClawCodexOAuthLogin(oauthPaste, (level, text, urls) =>
+            this.emitLog("configure_llm", level, text, urls || []),
+          );
+        } catch (err) {
+          const tail = `${err?.stderr || ""}\n${err?.stdout || ""}\n${err?.message || ""}`.trim();
+          throw new Error(
+            `${tail}\n\nIf OAuth cannot complete from the wizard, run in a shell: openclaw models auth login --provider openai-codex — then re-run the wizard with "already logged in" checked.`,
+          );
+        }
+      }
+
+      const selection = resolveLlmModelSelection(provider, requestedModel);
+      for (const msg of selection.warnings) {
+        this.emitLog("configure_llm", "warn", msg);
+      }
+      const model = selection.model;
+
+      const saved = configureOpenClawLlmModelPrimaryOnly({ provider, model });
+      this.emitLog(
+        "configure_llm",
+        "info",
+        `Configured OpenClaw model primary=${model} (Codex OAuth; credentials in OpenClaw auth profiles, not OPENAI_API_KEY).`,
+      );
+
+      await runCommandWithEvents("openclaw", ["config", "validate"], {
+        onEvent: (evt) => this.emitLog("configure_llm", evt.type === "stderr" ? "warn" : "info", evt.text, evt.urls || []),
+      });
+
+      try {
+        await runCommandWithEvents("openclaw", ["models", "status", "--check", "--probe-provider", provider], {
+          onEvent: (evt) => this.emitLog("configure_llm", evt.type === "stderr" ? "warn" : "info", evt.text, evt.urls || []),
+        });
+      } catch (err) {
+        const details = `${err?.stderr || ""}\n${err?.stdout || ""}\n${err?.message || ""}`.trim();
+        throw new Error(
+          `LLM provider validation failed for '${provider}'. Check OAuth login and model, then retry.\n${details}`,
+        );
+      }
+
+      return { configured: true, provider, model, configPath: saved.configPath, authMode: "oauth" };
+    }
+
+    if (!credential) {
+      throw new Error(
+        "Missing required LLM settings. Paste your API key or token in the wizard before starting installation.",
+      );
+    }
+
     const selection = resolveLlmModelSelection(provider, requestedModel);
     for (const msg of selection.warnings) {
       this.emitLog("configure_llm", "warn", msg);
@@ -1957,7 +2132,7 @@ export class InstallerStepEngine {
       );
     }
 
-    return { configured: true, provider, model, configPath: saved.configPath };
+    return { configured: true, provider, model, configPath: saved.configPath, authMode: "api_key" };
   }
 
   buildSetupHandoff() {

package/bin/openclaw-trader.mjs

@@ -6,7 +6,7 @@ import { dirname, join } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 import { homedir } from "os";
 import { randomUUID, createPrivateKey, sign as cryptoSign } from "crypto";
-import { execFile, execSync } from "child_process";
+import { execFile, execSync, spawn } from "child_process";
 import { promisify } from "util";
 import { createServer } from "http";
 import { resolvePluginPackageRoot } from "./resolve-plugin-root.mjs";
@@ -769,7 +769,7 @@ async function cmdSetup(args) {
       "\n  Optional: enter a referral code for bonus access time (24h extra when valid). Press Enter to skip.\n",
     );
     printInfo(
-      "  Benefits: extra trial time now; referring others later earns +8h per user who completes at least one trade with the agent.\n",
+      "  Benefits: extra trial time now; referring others later earns +24h per user who completes at least one trade with the agent.\n",
     );
     referralCodeArg = await prompt("Referral code (optional)", "");
   }
@@ -1689,6 +1689,9 @@ function parseInstallWizardArgs(args) {
     llmProvider: "",
     llmModel: "",
     llmCredential: "",
+    llmAuthMode: "api_key",
+    llmOAuthPaste: "",
+    llmOAuthSkipLogin: false,
     orchestratorUrl: "https://api.traderclaw.ai",
     gatewayBaseUrl: "",
     gatewayToken: "",
@@ -1709,6 +1712,12 @@ function parseInstallWizardArgs(args) {
     if (key === "--llm-provider" && next) out.llmProvider = args[++i];
     if (key === "--llm-model" && next) out.llmModel = args[++i];
     if ((key === "--llm-api-key" || key === "--llm-token") && next) out.llmCredential = args[++i];
+    if (key === "--llm-auth" && next) {
+      const v = args[++i];
+      out.llmAuthMode = v === "oauth" ? "oauth" : "api_key";
+    }
+    if (key === "--llm-oauth-paste" && next) out.llmOAuthPaste = args[++i];
+    if (key === "--llm-oauth-skip-login") out.llmOAuthSkipLogin = true;
     if ((key === "--url" || key === "-u") && next) out.orchestratorUrl = args[++i];
     if ((key === "--gateway-base-url" || key === "-g") && next) out.gatewayBaseUrl = args[++i];
     if ((key === "--gateway-token" || key === "-t") && next) out.gatewayToken = args[++i];
@@ -1867,7 +1876,7 @@ async function cmdPrecheck(args) {
 
   log.info("Manual staging run commands:");
   log.info("  1) traderclaw install --wizard");
-  log.info("  2) In wizard, set LLM provider + credential and Telegram token");
+  log.info("  2) In wizard, set LLM (API key or Codex OAuth) and Telegram token");
   log.info("  3) Approve tailscale login in provided URL");
   log.info("  4) Confirm /v1/responses returns non-404 on funnel host");
   log.info("  5) Verify Telegram channel setup + probe");
@@ -1944,7 +1953,13 @@ async function loadWizardLlmCatalogAsync() {
       },
       {
         id: "openai-codex",
-        models: [{ id: "openai-codex/gpt-5-codex", name: "GPT-5 Codex" }],
+        models: [
+          { id: "openai-codex/gpt-5.4", name: "GPT-5.4 Codex (recommended, ChatGPT OAuth)" },
+          {
+            id: "openai-codex/gpt-5.3-codex-spark",
+            name: "GPT-5.3 Codex Spark (subscription entitlement; experimental)",
+          },
+        ],
       },
       {
         id: "google",
@@ -2027,7 +2042,8 @@ function wizardHtml(defaults) {
       .card { background:#121a31; border:1px solid #22315a; border-radius: 12px; padding: 16px; margin-bottom: 16px; }
       .grid { display:grid; grid-template-columns:1fr 1fr; gap: 12px; }
       label { display:block; font-size: 12px; color:#9cb0de; margin-bottom: 4px; }
-      input, select { width:100%; padding:10px; border-radius:8px; border:1px solid #334a87; background:#0d1530; color:#e8eef9; }
+      input, select, textarea { width:100%; padding:10px; border-radius:8px; border:1px solid #334a87; background:#0d1530; color:#e8eef9; font-family: inherit; font-size: 14px; box-sizing: border-box; }
+      textarea { min-height: 88px; resize: vertical; }
       button { border:0; border-radius:8px; padding:10px 14px; background:#4d7cff; color:#fff; cursor:pointer; font-weight:600; }
       button:disabled { opacity:0.6; cursor:not-allowed; }
       .muted { color:#9cb0de; font-size:13px; }
@@ -2059,6 +2075,15 @@ function wizardHtml(defaults) {
       .muted a:hover { color:#c5e5ff; }
       .info-dot { display:inline-flex; align-items:center; justify-content:center; width:18px; height:18px; border-radius:50%; background:#22315a; color:#9cb0de; font-size:11px; font-weight:700; cursor:help; flex-shrink:0; }
       @keyframes spin { to { transform:rotate(360deg); } }
+      .oauth-flow { background:#0d1530; border:1px solid #334a87; border-radius:10px; padding:14px; margin-top:10px; }
+      .oauth-flow ol { margin:8px 0 0 18px; padding:0; color:#c5d7f5; font-size:13px; line-height:1.5; }
+      .oauth-flow li { margin-bottom:8px; }
+      .oauth-row { display:flex; gap:8px; flex-wrap:wrap; align-items:center; margin-top:10px; }
+      .oauth-row input[readonly] { flex:1 1 280px; font-size:12px; }
+      .oauth-actions { display:flex; gap:8px; flex-wrap:wrap; margin-top:10px; }
+      .oauth-actions button.secondary { background:#334a87; }
+      .ok-banner { color:#78f0a9; font-size:13px; margin-top:8px; }
+      .err-banner { color:#ff6b6b; font-size:13px; margin-top:8px; }
     </style>
   </head>
   <body>
@@ -2069,9 +2094,20 @@ function wizardHtml(defaults) {
       </div>
       <div class="card" id="llmCard">
         <h3>Required: OpenClaw LLM Provider</h3>
-        <p class="muted">Pick your LLM provider and paste your credential. Beginner mode supports common API-key providers.</p>
-        <div class="grid">
-          <div>
+        <p class="muted">Use an API key for OpenAI Platform and other providers, or ChatGPT/Codex OAuth for subscription access (no separate API billing). OAuth tokens are stored by OpenClaw — not as <code>OPENAI_API_KEY</code>.</p>
+        <div style="margin-bottom:12px;">
+          <label style="margin-bottom:8px;">LLM authentication</label>
+          <label style="display:flex; align-items:flex-start; gap:8px; font-size:14px; color:#e8eef9; margin-bottom:6px; cursor:pointer;">
+            <input id="llmAuthModeApiKey" name="llmAuthMode" type="radio" value="api_key" style="width:auto; margin-top:3px;" checked />
+            <span><strong>API key</strong> — OpenAI Platform (<code>openai</code>), Anthropic, OpenRouter, etc.</span>
+          </label>
+          <label style="display:flex; align-items:flex-start; gap:8px; font-size:14px; color:#e8eef9; cursor:pointer;">
+            <input id="llmAuthModeOauth" name="llmAuthMode" type="radio" value="oauth" style="width:auto; margin-top:3px;" />
+            <span><strong>ChatGPT / Codex (OAuth)</strong> — provider <code>openai-codex</code> (Plus/Pro subscription via OpenClaw login)</span>
+          </label>
+        </div>
+        <div class="grid" id="llmProviderModelGrid">
+          <div id="llmProviderWrap">
             <label>LLM provider (required)</label>
             <select id="llmProvider"></select>
           </div>
@@ -2080,21 +2116,54 @@ function wizardHtml(defaults) {
             <select id="llmModel"></select>
           </div>
         </div>
+        <p class="muted hidden" id="llmOauthProviderNote">Provider is fixed to <code>openai-codex</code>. Pick a Codex model below (or enable manual selection).</p>
         <div style="margin-top:8px;">
           <label style="display:flex; align-items:center; gap:8px; font-size:13px; color:#9cb0de;">
             <input id="llmModelManual" type="checkbox" style="width:auto; padding:0; margin:0;" />
             Choose model manually (advanced)
           </label>
         </div>
-        <div style="margin-top:12px;">
+        <div style="margin-top:12px;" id="llmApiKeyBlock">
           <label>LLM API key or token (required)</label>
           <input id="llmCredential" type="password" placeholder="Paste the credential for the selected provider/model" />
-          <p class="muted">This credential is written to OpenClaw model provider config so your agent can run. If you skip manual model selection, the installer will choose a safe provider default.</p>
-          <p class="muted" id="llmLoadState" aria-live="polite">Loading LLM provider catalog...</p>
-          <div id="llmLoadingHint" class="loading-hint" role="status" aria-live="polite">
-            <span class="spinner" aria-hidden="true"></span>
-            <span id="llmLoadingHintText">Fetching provider list...</span>
+          <p class="muted">Written to OpenClaw <code>config.env</code> for the selected provider. If you do not choose a model manually, the installer picks a safe default.</p>
+        </div>
+        <div style="margin-top:12px;" id="llmOauthBlock" class="hidden">
+          <p class="muted" style="margin-bottom:10px;">
+            Follow the flow below to sign in with ChatGPT and submit your login to OpenClaw.
+          </p>
+          <div class="oauth-flow">
+            <strong style="color:#9ee6ff;">Guided sign-in (recommended)</strong>
+            <ol>
+              <li>Click <strong>Get ChatGPT sign-in link</strong> — we run the same command as OpenClaw and show the long <code>https://auth.openai.com/oauth/authorize?…</code> URL here.</li>
+              <li>Open that URL in your <strong>local</strong> browser (on your PC if this is SSH), sign in with ChatGPT.</li>
+              <li>After login, copy either the <strong>full URL</strong> from the address bar or the <strong>code</strong> from the prompt, and paste into the box below.</li>
+              <li>Click <strong>Submit to OpenClaw</strong>. When it succeeds, you can start installation — no need to guess what to paste.</li>
+            </ol>
+            <div class="oauth-actions">
+              <button type="button" id="oauthGetLinkBtn" class="secondary">1. Get ChatGPT sign-in link</button>
+              <button type="button" id="oauthSubmitBtn" class="secondary" disabled>3. Submit to OpenClaw</button>
+            </div>
+            <div id="oauthUrlRow" class="oauth-row hidden">
+              <label style="flex:1 1 100%; font-size:12px; color:#9cb0de;">Sign-in URL (open this in your browser — this is not what you paste back)</label>
+              <input type="text" id="oauthUrlDisplay" readonly placeholder="Click “Get ChatGPT sign-in link” first" />
+              <button type="button" id="oauthCopyUrlBtn" class="secondary" disabled>Copy URL</button>
+              <a id="oauthOpenUrlBtn" class="secondary" href="#" target="_blank" rel="noopener noreferrer" style="display:inline-block;padding:10px 14px;border-radius:8px;background:#2d7dff;color:#fff;text-decoration:none;font-weight:600;">Open in browser</a>
+            </div>
+            <p id="oauthFlowStatus" class="muted" style="margin-top:8px;" aria-live="polite"></p>
           </div>
+          <label style="margin-top:14px;">Paste redirect URL or authorization code (step 2 → 3)</label>
+          <textarea id="llmOAuthPaste" autocomplete="off" placeholder="After signing in at ChatGPT, paste here: the full http://127.0.0.1:1455/... or http://localhost:1455/... URL from your browser, OR the code string if the prompt asks for the code only."></textarea>
+          <label style="display:flex; align-items:flex-start; gap:8px; font-size:13px; color:#9cb0de; margin-top:8px; cursor:pointer;">
+            <input id="llmOAuthSkipLogin" type="checkbox" style="width:auto; margin-top:3px;" />
+            <span>I already completed <code>openclaw models auth login --provider openai-codex</code> in a terminal on <strong>this</strong> machine (skip the buttons above)</span>
+          </label>
+          <p class="muted">SSH tip: the browser must reach your machine for localhost callbacks; if that fails, run the same login command in a desktop terminal on this host, then use the checkbox.</p>
+        </div>
+        <p class="muted" id="llmLoadState" aria-live="polite">Loading LLM provider catalog...</p>
+        <div id="llmLoadingHint" class="loading-hint" role="status" aria-live="polite">
+          <span class="spinner" aria-hidden="true"></span>
+          <span id="llmLoadingHintText">Fetching provider list...</span>
         </div>
       </div>
       <div class="card" id="xCard">
@@ -2137,10 +2206,10 @@ function wizardHtml(defaults) {
         </div>
         <div style="margin-top:12px;">
           <label style="display:flex;align-items:center;gap:8px;">Referral code (optional)
-            <span class="info-dot" title="Included access: 24 hours for every new account. Add a valid referral code for an extra 24 hours. Refer others: when they complete at least one trade with the agent, you earn +8 hours per active referral. When your access window ends, you will need to stake or keep referring to continue.">i</span>
+            <span class="info-dot" title="Included access: 24 hours for every new account. Add a valid referral code for an extra 24 hours. Refer others: when they complete at least one trade with the agent, you earn +24 hours per active referral. When your access window ends, you will need to stake or keep referring to continue.">i</span>
           </label>
           <input id="referralCode" type="text" maxlength="16" autocomplete="off" placeholder="e.g. ABCD1234" />
-          <p class="muted">If you have a friend’s code, enter it here. The setup command below will include it for <code>traderclaw setup</code>. If the server rejects the code, clear this field or fix it and copy the updated command — or run <code>traderclaw setup</code> again and enter a valid code or leave referral blank when prompted.</p>
+          <p class="muted">Included access: 24 hours for every new account. Add a valid referral code for an extra 24 hours. Refer others: when they complete at least one trade with the agent, you earn +24 hours per active referral. When your access window ends, you will need to stake or keep referring to continue.</p>
         </div>
         <button id="start" disabled>Start Installation</button>
       </div>
@@ -2228,6 +2297,14 @@ function wizardHtml(defaults) {
       const llmModelEl = document.getElementById("llmModel");
       const llmModelManualEl = document.getElementById("llmModelManual");
       const llmCredentialEl = document.getElementById("llmCredential");
+      const llmAuthModeApiKey = document.getElementById("llmAuthModeApiKey");
+      const llmAuthModeOauth = document.getElementById("llmAuthModeOauth");
+      const llmProviderWrap = document.getElementById("llmProviderWrap");
+      const llmOauthProviderNote = document.getElementById("llmOauthProviderNote");
+      const llmApiKeyBlock = document.getElementById("llmApiKeyBlock");
+      const llmOauthBlock = document.getElementById("llmOauthBlock");
+      const llmOAuthPasteEl = document.getElementById("llmOAuthPaste");
+      const llmOAuthSkipLoginEl = document.getElementById("llmOAuthSkipLogin");
       const telegramTokenEl = document.getElementById("telegramToken");
       const llmLoadStateEl = document.getElementById("llmLoadState");
       const llmLoadingHintEl = document.getElementById("llmLoadingHint");
@@ -2254,14 +2331,109 @@ function wizardHtml(defaults) {
       let pollTimer = null;
       let pollIntervalMs = 1200;
       let installLocked = false;
+      let savedApiKeyProvider = "";
+      let oauthSessionId = null;
+      let oauthWizardLoginDone = false;
+
+      const oauthGetLinkBtn = document.getElementById("oauthGetLinkBtn");
+      const oauthSubmitBtn = document.getElementById("oauthSubmitBtn");
+      const oauthUrlRow = document.getElementById("oauthUrlRow");
+      const oauthUrlDisplay = document.getElementById("oauthUrlDisplay");
+      const oauthCopyUrlBtn = document.getElementById("oauthCopyUrlBtn");
+      const oauthOpenUrlBtn = document.getElementById("oauthOpenUrlBtn");
+      const oauthFlowStatus = document.getElementById("oauthFlowStatus");
+
+      async function cancelOauthSession() {
+        if (!oauthSessionId) {
+          try {
+            await fetch("/api/llm/oauth/cancel", { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
+          } catch {
+            /* ignore */
+          }
+          return;
+        }
+        try {
+          await fetch("/api/llm/oauth/cancel", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ sessionId: oauthSessionId }),
+          });
+        } catch {
+          /* ignore */
+        }
+        oauthSessionId = null;
+      }
+
+      function resetOauthWizardState() {
+        oauthSessionId = null;
+        oauthWizardLoginDone = false;
+        if (oauthUrlRow) oauthUrlRow.classList.add("hidden");
+        if (oauthUrlDisplay) oauthUrlDisplay.value = "";
+        if (oauthCopyUrlBtn) oauthCopyUrlBtn.disabled = true;
+        if (oauthOpenUrlBtn) {
+          oauthOpenUrlBtn.href = "#";
+          oauthOpenUrlBtn.setAttribute("aria-disabled", "true");
+        }
+        if (oauthSubmitBtn) oauthSubmitBtn.disabled = true;
+        if (oauthFlowStatus) oauthFlowStatus.textContent = "";
+      }
+
+      (function initLlmAuthDefaults() {
+        const mode = ${JSON.stringify(defaults.llmAuthMode || "api_key")};
+        if (mode === "oauth") {
+          llmAuthModeOauth.checked = true;
+          llmAuthModeApiKey.checked = false;
+        }
+        llmOAuthPasteEl.value = ${JSON.stringify(defaults.llmOAuthPaste || "")};
+        if (${defaults.llmOAuthSkipLogin === true ? "true" : "false"}) {
+          llmOAuthSkipLoginEl.checked = true;
+        }
+        applyLlmAuthModeUi();
+      })();
+
+      function isOauthMode() {
+        return llmAuthModeOauth && llmAuthModeOauth.checked;
+      }
+
+      function effectiveLlmProvider() {
+        return isOauthMode() ? "openai-codex" : llmProviderEl.value.trim();
+      }
+
+      function applyLlmAuthModeUi() {
+        if (!llmProviderWrap || !llmApiKeyBlock || !llmOauthBlock) return;
+        if (isOauthMode()) {
+          savedApiKeyProvider = llmProviderEl.value || savedApiKeyProvider;
+          llmProviderEl.value = "openai-codex";
+          llmProviderWrap.classList.add("hidden");
+          llmOauthProviderNote.classList.remove("hidden");
+          llmApiKeyBlock.classList.add("hidden");
+          llmOauthBlock.classList.remove("hidden");
+        } else {
+          void cancelOauthSession();
+          resetOauthWizardState();
+          llmProviderWrap.classList.remove("hidden");
+          llmOauthProviderNote.classList.add("hidden");
+          llmApiKeyBlock.classList.remove("hidden");
+          llmOauthBlock.classList.add("hidden");
+          if (savedApiKeyProvider) {
+            llmProviderEl.value = savedApiKeyProvider;
+          }
+        }
+      }
+
+      function onLlmAuthModeChange() {
+        applyLlmAuthModeUi();
+        refreshModelOptions("");
+      }
 
       function hasRequiredInputs() {
-        return (
-          llmCatalogReady
-          && Boolean(llmProviderEl.value.trim())
-          && Boolean(llmCredentialEl.value.trim())
-          && Boolean(telegramTokenEl.value.trim())
-        );
+        if (!llmCatalogReady || !Boolean(telegramTokenEl.value.trim())) return false;
+        if (isOauthMode()) {
+          if (oauthWizardLoginDone) return true;
+          if (llmOAuthSkipLoginEl.checked) return true;
+          return Boolean(llmOAuthPasteEl.value.trim());
+        }
+        return Boolean(llmProviderEl.value.trim()) && Boolean(llmCredentialEl.value.trim());
       }
 
       /** All-or-nothing: 0 or 4 non-empty X fields; partial is invalid. */
@@ -2348,7 +2520,7 @@ function wizardHtml(defaults) {
       }
 
       function refreshModelOptions(preferredModel) {
-        const provider = llmProviderEl.value;
+        const provider = effectiveLlmProvider();
         const providerEntry = (llmCatalog.providers || []).find((entry) => entry.id === provider);
         const modelItems = (providerEntry ? providerEntry.models : []).map((item) => ({ value: item.id, label: item.name + " (" + item.id + ")" }));
         if (modelItems.length === 0) {
@@ -2378,8 +2550,9 @@ function wizardHtml(defaults) {
             return;
           }
           setSelectOptions(llmProviderEl, providers, "${defaults.llmProvider}");
+          applyLlmAuthModeUi();
           refreshModelOptions("${defaults.llmModel}");
-          const catalogMsg = "Select your provider, paste your API key, and start installation. After setup, run \`openclaw models list\` to explore your live catalog.";
+          const catalogMsg = "Choose API key or Codex OAuth, then start installation. After setup, run \`openclaw models list\` for your live catalog.";
           setLlmCatalogReady(true, catalogMsg, false);
         } catch (err) {
           setLlmCatalogReady(false, "Failed to load LLM providers. Reload the page and try again.", true);
@@ -2433,10 +2606,14 @@ function wizardHtml(defaults) {
         manualEl.textContent = "";
         readyEl.textContent = "Starting installation...";
 
+        const oauth = isOauthMode();
         const payload = {
-          llmProvider: llmProviderEl.value.trim(),
+          llmAuthMode: oauth ? "oauth" : "api_key",
+          llmProvider: oauth ? "openai-codex" : llmProviderEl.value.trim(),
           llmModel: llmModelEl.value.trim(),
-          llmCredential: llmCredentialEl.value.trim(),
+          llmCredential: oauth ? "" : llmCredentialEl.value.trim(),
+          llmOAuthPaste: llmOAuthPasteEl.value.trim(),
+          llmOAuthSkipLogin: llmOAuthSkipLoginEl.checked,
           apiKey: document.getElementById("apiKey").value.trim(),
           telegramToken: document.getElementById("telegramToken").value.trim(),
           referralCode: document.getElementById("referralCode").value.trim(),
@@ -2445,10 +2622,22 @@ function wizardHtml(defaults) {
           xAccessTokenMain: xAccessTokenMainEl.value.trim(),
           xAccessTokenMainSecret: xAccessTokenMainSecretEl.value.trim(),
         };
-        if (!payload.llmProvider || !payload.llmCredential) {
+        if (oauth && oauthWizardLoginDone) {
+          payload.llmOAuthSkipLogin = true;
+          payload.llmOAuthPaste = "";
+        }
+        if (oauth) {
+          if (!payload.llmOAuthSkipLogin && !payload.llmOAuthPaste && !oauthWizardLoginDone) {
+            stateEl.textContent = "blocked";
+            readyEl.textContent = "";
+            manualEl.textContent =
+              "Codex OAuth: use “Get ChatGPT sign-in link” and “Submit to OpenClaw”, paste a redirect URL/code, or check the box if you already ran openclaw models auth login on this machine.";
+            return;
+          }
+        } else if (!payload.llmProvider || !payload.llmCredential) {
           stateEl.textContent = "blocked";
           readyEl.textContent = "";
-          manualEl.textContent = "LLM provider and credential are required before starting installation.";
+          manualEl.textContent = "LLM provider and API key are required before starting installation.";
           return;
         }
         if (!payload.telegramToken) {
@@ -2690,7 +2879,130 @@ function wizardHtml(defaults) {
         llmModelEl.disabled = !llmModelManualEl.checked;
         updateStartButtonState();
       });
+      llmAuthModeApiKey.addEventListener("change", onLlmAuthModeChange);
+      llmAuthModeOauth.addEventListener("change", onLlmAuthModeChange);
       llmCredentialEl.addEventListener("input", updateStartButtonState);
+      llmOAuthPasteEl.addEventListener("input", updateStartButtonState);
+      llmOAuthSkipLoginEl.addEventListener("change", updateStartButtonState);
+
+      if (oauthGetLinkBtn) {
+        oauthGetLinkBtn.addEventListener("click", async () => {
+          oauthWizardLoginDone = false;
+          if (oauthFlowStatus) {
+            oauthFlowStatus.className = "muted";
+            oauthFlowStatus.textContent = "Starting OpenClaw (same as running models auth login in a terminal)...";
+          }
+          oauthGetLinkBtn.disabled = true;
+          try {
+            const res = await fetch("/api/llm/oauth/start", { method: "POST" });
+            const data = await res.json().catch(() => ({}));
+            if (!res.ok) {
+              if (oauthFlowStatus) {
+                oauthFlowStatus.className = "err-banner";
+                oauthFlowStatus.textContent = data.message || data.error || "Could not get sign-in URL.";
+              }
+              oauthGetLinkBtn.disabled = false;
+              return;
+            }
+            oauthSessionId = data.sessionId;
+            if (oauthUrlDisplay) oauthUrlDisplay.value = data.authUrl || "";
+            if (oauthUrlRow) oauthUrlRow.classList.remove("hidden");
+            if (oauthCopyUrlBtn) oauthCopyUrlBtn.disabled = !data.authUrl;
+            if (oauthOpenUrlBtn && data.authUrl) {
+              oauthOpenUrlBtn.href = data.authUrl;
+              oauthOpenUrlBtn.removeAttribute("aria-disabled");
+            }
+            if (oauthSubmitBtn) oauthSubmitBtn.disabled = false;
+            if (oauthFlowStatus) {
+              oauthFlowStatus.className = "muted";
+              oauthFlowStatus.textContent =
+                "Open this URL in your browser (on your PC if you use SSH). After ChatGPT sign-in, paste the localhost redirect URL or the code, then click Submit.";
+            }
+          } catch (err) {
+            if (oauthFlowStatus) {
+              oauthFlowStatus.className = "err-banner";
+              oauthFlowStatus.textContent = err && err.message ? String(err.message) : "Request failed.";
+            }
+          }
+          oauthGetLinkBtn.disabled = false;
+        });
+      }
+
+      if (oauthSubmitBtn) {
+        oauthSubmitBtn.addEventListener("click", async () => {
+          const paste = llmOAuthPasteEl.value.trim();
+          if (!paste) {
+            if (oauthFlowStatus) {
+              oauthFlowStatus.className = "err-banner";
+              oauthFlowStatus.textContent = "Paste the redirect URL (from the browser address bar) or the authorization code first.";
+            }
+            return;
+          }
+          if (!oauthSessionId) {
+            if (oauthFlowStatus) {
+              oauthFlowStatus.className = "err-banner";
+              oauthFlowStatus.textContent = "Click “Get ChatGPT sign-in link” first, or use the “already completed login in terminal” checkbox.";
+            }
+            return;
+          }
+          oauthSubmitBtn.disabled = true;
+          if (oauthFlowStatus) {
+            oauthFlowStatus.className = "muted";
+            oauthFlowStatus.textContent = "Sending to OpenClaw...";
+          }
+          try {
+            const res = await fetch("/api/llm/oauth/submit", {
+              method: "POST",
+              headers: { "content-type": "application/json" },
+              body: JSON.stringify({ sessionId: oauthSessionId, paste }),
+            });
+            const data = await res.json().catch(() => ({}));
+            if (!res.ok) {
+              if (oauthFlowStatus) {
+                oauthFlowStatus.className = "err-banner";
+                oauthFlowStatus.textContent = data.message || data.error || "Login failed.";
+              }
+              oauthSubmitBtn.disabled = false;
+              return;
+            }
+            oauthWizardLoginDone = true;
+            oauthSessionId = null;
+            llmOAuthSkipLoginEl.checked = true;
+            if (oauthFlowStatus) {
+              oauthFlowStatus.className = "ok-banner";
+              oauthFlowStatus.textContent = "OpenClaw saved your ChatGPT login. You can start installation below.";
+            }
+            oauthSubmitBtn.disabled = true;
+            updateStartButtonState();
+          } catch (err) {
+            if (oauthFlowStatus) {
+              oauthFlowStatus.className = "err-banner";
+              oauthFlowStatus.textContent = err && err.message ? String(err.message) : "Request failed.";
+            }
+            oauthSubmitBtn.disabled = false;
+          }
+        });
+      }
+
+      if (oauthCopyUrlBtn && oauthUrlDisplay) {
+        oauthCopyUrlBtn.addEventListener("click", async () => {
+          const v = oauthUrlDisplay.value;
+          if (!v) return;
+          try {
+            await navigator.clipboard.writeText(v);
+            oauthCopyUrlBtn.textContent = "Copied";
+            setTimeout(() => {
+              oauthCopyUrlBtn.textContent = "Copy URL";
+            }, 1500);
+          } catch {
+            oauthCopyUrlBtn.textContent = "Copy failed";
+            setTimeout(() => {
+              oauthCopyUrlBtn.textContent = "Copy URL";
+            }, 1500);
+          }
+        });
+      }
+
       telegramTokenEl.addEventListener("input", updateStartButtonState);
       xConsumerKeyEl.addEventListener("input", updateStartButtonState);
       xConsumerSecretEl.addEventListener("input", updateStartButtonState);
@@ -2732,6 +3044,31 @@ async function cmdInstall(args) {
   let running = false;
   let shuttingDown = false;
 
+  /** In-browser Codex OAuth: one pending `openclaw models auth login` child waiting for stdin (same flow as CLI). */
+  const oauthSessions = new Map();
+  const OPENAI_OAUTH_AUTHORIZE_RE = /https:\/\/auth\.openai\.com\/oauth\/authorize\S*/;
+  const oauthSessionTtlMs = 15 * 60 * 1000;
+
+  function killOauthSession(sessionId, signal = "SIGTERM") {
+    const s = oauthSessions.get(sessionId);
+    if (!s) return;
+    try {
+      s.child.kill(signal);
+    } catch {
+      /* ignore */
+    }
+    oauthSessions.delete(sessionId);
+  }
+
+  function pruneExpiredOauthSessions() {
+    const now = Date.now();
+    for (const [id, s] of oauthSessions) {
+      if (now - s.createdAt > oauthSessionTtlMs) {
+        killOauthSession(id);
+      }
+    }
+  }
+
   const server = createServer(async (req, res) => {
     const respondJson = (code, payload) => {
       res.statusCode = code;
@@ -2795,6 +3132,169 @@ async function cmdInstall(args) {
       return;
     }
 
+    if (req.method === "POST" && req.url === "/api/llm/oauth/start") {
+      pruneExpiredOauthSessions();
+      if (running) {
+        respondJson(409, { ok: false, error: "install_in_progress" });
+        return;
+      }
+      if (!commandExists("openclaw")) {
+        respondJson(503, {
+          ok: false,
+          error: "openclaw_not_in_path",
+          message: "Install OpenClaw on this machine first (e.g. npm install -g openclaw), then try again.",
+        });
+        return;
+      }
+      for (const id of [...oauthSessions.keys()]) {
+        killOauthSession(id);
+      }
+
+      const sessionId = randomUUID();
+      const child = spawn("openclaw", ["models", "auth", "login", "--provider", "openai-codex"], {
+        stdio: ["pipe", "pipe", "pipe"],
+        shell: false,
+      });
+
+      let combined = "";
+      let responded = false;
+      const urlTimeout = setTimeout(() => {
+        if (responded) return;
+        responded = true;
+        try {
+          child.kill("SIGTERM");
+        } catch {
+          /* ignore */
+        }
+        oauthSessions.delete(sessionId);
+        respondJson(504, {
+          ok: false,
+          error: "oauth_url_timeout",
+          message:
+            "OpenClaw did not print a ChatGPT sign-in URL in time. Run `openclaw models auth login --provider openai-codex` in a terminal on this machine, then use the checkbox below.",
+        });
+      }, 45_000);
+
+      const trySendUrl = () => {
+        if (responded) return;
+        const m = combined.match(OPENAI_OAUTH_AUTHORIZE_RE);
+        if (!m || !m[0]) return;
+        clearTimeout(urlTimeout);
+        responded = true;
+        oauthSessions.set(sessionId, { child, createdAt: Date.now(), submitted: false });
+        respondJson(200, { ok: true, sessionId, authUrl: m[0] });
+      };
+
+      child.stdout?.on("data", (d) => {
+        combined += d.toString();
+        trySendUrl();
+      });
+      child.stderr?.on("data", (d) => {
+        combined += d.toString();
+        trySendUrl();
+      });
+      child.on("error", (err) => {
+        clearTimeout(urlTimeout);
+        if (responded) return;
+        responded = true;
+        oauthSessions.delete(sessionId);
+        respondJson(500, { ok: false, error: "spawn_failed", message: err.message });
+      });
+      child.on("close", (code) => {
+        clearTimeout(urlTimeout);
+        if (!responded) {
+          responded = true;
+          oauthSessions.delete(sessionId);
+          respondJson(500, {
+            ok: false,
+            error: "oauth_login_exited_early",
+            exitCode: code,
+            detail: combined.slice(-4000),
+          });
+          return;
+        }
+        const pending = oauthSessions.get(sessionId);
+        if (pending && !pending.submitted) {
+          oauthSessions.delete(sessionId);
+        }
+      });
+      return;
+    }
+
+    if (req.method === "POST" && req.url === "/api/llm/oauth/submit") {
+      const body = await parseJsonBody(req).catch(() => ({}));
+      const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+      const paste = typeof body.paste === "string" ? body.paste.trim() : "";
+      if (!sessionId || !oauthSessions.has(sessionId)) {
+        respondJson(400, { ok: false, error: "invalid_or_expired_session", message: "Click “Get ChatGPT sign-in link” again." });
+        return;
+      }
+      if (!paste) {
+        respondJson(400, { ok: false, error: "paste_required" });
+        return;
+      }
+      const s = oauthSessions.get(sessionId);
+      s.submitted = true;
+      const { child } = s;
+
+      await new Promise((resolve) => {
+        let settled = false;
+        let submitTimeout;
+        const finish = (httpCode, payload) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(submitTimeout);
+          oauthSessions.delete(sessionId);
+          respondJson(httpCode, payload);
+          resolve();
+        };
+
+        submitTimeout = setTimeout(() => {
+          killOauthSession(sessionId);
+          finish(504, {
+            ok: false,
+            error: "oauth_submit_timeout",
+            message: "Login did not finish in time. Try again or complete login in a normal terminal.",
+          });
+        }, 120_000);
+
+        child.once("close", (code) => {
+          if (code === 0) {
+            finish(200, { ok: true });
+          } else {
+            finish(500, {
+              ok: false,
+              error: "oauth_login_failed",
+              exitCode: code,
+              message: "OpenClaw rejected the pasted URL or code. Paste the full redirect URL from the browser address bar, or run login in a terminal.",
+            });
+          }
+        });
+
+        try {
+          child.stdin.write(`${paste}\n`);
+        } catch (err) {
+          killOauthSession(sessionId);
+          finish(500, { ok: false, error: "stdin_write_failed", message: err?.message || String(err) });
+        }
+      });
+      return;
+    }
+
+    if (req.method === "POST" && req.url === "/api/llm/oauth/cancel") {
+      const body = await parseJsonBody(req).catch(() => ({}));
+      const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+      if (sessionId && oauthSessions.has(sessionId)) {
+        killOauthSession(sessionId);
+      } else {
+        for (const id of [...oauthSessions.keys()]) {
+          killOauthSession(id);
+        }
+      }
+      respondJson(200, { ok: true });
+      return;
+    }
+
     if (req.method === "POST" && req.url === "/api/finish") {
       if (running || runtime.status !== "completed") {
         respondJson(409, { ok: false, error: "wizard_not_completed" });
@@ -2831,12 +3331,17 @@ async function cmdInstall(args) {
       }
 
       const body = await parseJsonBody(req).catch(() => ({}));
+      const rawLlmAuth = body.llmAuthMode != null ? body.llmAuthMode : defaults.llmAuthMode;
       const wizardOpts = {
         mode: "light",
         lane: defaults.lane,
+        llmAuthMode: rawLlmAuth === "oauth" ? "oauth" : "api_key",
         llmProvider: body.llmProvider || defaults.llmProvider,
         llmModel: body.llmModel || defaults.llmModel,
         llmCredential: body.llmCredential || defaults.llmCredential,
+        llmOAuthPaste: typeof body.llmOAuthPaste === "string" ? body.llmOAuthPaste.trim() : defaults.llmOAuthPaste,
+        llmOAuthSkipLogin:
+          typeof body.llmOAuthSkipLogin === "boolean" ? body.llmOAuthSkipLogin : defaults.llmOAuthSkipLogin === true,
         apiKey: body.apiKey || defaults.apiKey,
         orchestratorUrl: defaults.orchestratorUrl,
         gatewayBaseUrl: defaults.gatewayBaseUrl,
@@ -2870,9 +3375,12 @@ async function cmdInstall(args) {
         {
           mode: "light",
           lane: defaults.lane,
+          llmAuthMode: wizardOpts.llmAuthMode,
           llmProvider: body.llmProvider || defaults.llmProvider,
           llmModel: body.llmModel || defaults.llmModel,
           llmCredential: body.llmCredential || defaults.llmCredential,
+          llmOAuthPaste: wizardOpts.llmOAuthPaste,
+          llmOAuthSkipLogin: wizardOpts.llmOAuthSkipLogin,
           apiKey: body.apiKey || defaults.apiKey,
           orchestratorUrl: defaults.orchestratorUrl,
           gatewayBaseUrl: defaults.gatewayBaseUrl,
@@ -3240,6 +3748,15 @@ Config subcommands:
   config set <k> <v> Update a configuration value
   config reset       Remove plugin configuration
 
+Install wizard (traderclaw install --wizard):
+  --port                 Local port for the wizard (default 17890)
+  --llm-provider         e.g. openai, openai-codex, anthropic
+  --llm-model            e.g. openai/gpt-5.4 or openai-codex/gpt-5.4
+  --llm-api-key, --llm-token   API key for LLM (api_key mode)
+  --llm-auth api_key|oauth     OpenAI Platform key vs ChatGPT/Codex OAuth (openai-codex)
+  --llm-oauth-paste    Paste redirect URL or code for Codex OAuth (non-skip)
+  --llm-oauth-skip-login       Skip login when you already ran openclaw models auth login
+
 Examples:
   traderclaw signup
   traderclaw setup
@@ -3249,6 +3766,7 @@ Examples:
   traderclaw precheck --allow-install
   traderclaw install --wizard
   traderclaw install --wizard --lane quick-local
+  traderclaw install --wizard --llm-auth oauth --llm-provider openai-codex --llm-oauth-skip-login
   traderclaw repair-openclaw
   traderclaw gateway ensure-persistent
   traderclaw setup --signup --user-id my_agent_001 --referral-code ABCD1234

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "traderclaw-cli",
-  "version": "1.0.73",
+  "version": "1.0.75",
   "description": "Global TraderClaw CLI (install --wizard, setup, precheck). Installs solana-traderclaw as a dependency for OpenClaw plugin files.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "solana-traderclaw": "^1.0.73"
+    "solana-traderclaw": "^1.0.75"
   },
   "keywords": [
     "traderclaw",