docs: consolidate codex oauth current status
This commit is contained in:
+266
@@ -0,0 +1,266 @@
|
||||
# Codex OAuth onboarding status summary (2026-05-10)
|
||||
|
||||
This document consolidates the current Hermes-driven Codex2API/OpenAI OAuth onboarding findings, local automation changes, and failed phone-verification attempts. Secrets, full proxy strings, passwords, API keys, full phone numbers, and callback URLs are intentionally omitted.
|
||||
|
||||
## Current objective
|
||||
|
||||
Run a single OpenAI/Codex OAuth registration/onboarding flow through Codex2API using:
|
||||
|
||||
- fresh ClawEmail sub-mailbox;
|
||||
- 1085 proxy/browser profile;
|
||||
- OpenAI email verification;
|
||||
- OpenAI add-phone phone verification;
|
||||
- 5sim SMS activation only, not WhatsApp.
|
||||
|
||||
## Stable environment facts
|
||||
|
||||
- Codex2API OAuth target is configured in `~/.hermes/env/codex_oauth_onboarding.env`.
|
||||
- 5sim provider is configured for SMS activation:
|
||||
- `PHONE_SMS_PROVIDER=5sim`
|
||||
- `FIVE_SIM_OPERATOR=any`
|
||||
- `FIVE_SIM_PRODUCT=openai`
|
||||
- `FIVE_SIM_SERVICE=openai`
|
||||
- The original 5sim activation endpoint shape remains:
|
||||
- `/v1/user/buy/activation/{country}/any/openai`
|
||||
- BOSS requested SMS-only. Do not switch to WhatsApp providers unless BOSS explicitly approves.
|
||||
|
||||
## ClawEmail mailbox and permission flow
|
||||
|
||||
Old sub-mailboxes were deleted to clear quota.
|
||||
|
||||
Fresh mailbox created:
|
||||
|
||||
```text
|
||||
chickliu.wnjmwncq@claw.163.com
|
||||
```
|
||||
|
||||
Important ClawEmail discovery:
|
||||
|
||||
- Newly-created sub-mailboxes defaulted to internal-only receive:
|
||||
- `commLevel=1`
|
||||
- `extReceiveType=0`
|
||||
- OpenAI verification emails do not arrive until external receive is enabled.
|
||||
|
||||
Persistent ClawEmail Dashboard browser profile:
|
||||
|
||||
```text
|
||||
/Users/chick/.Hermes/workspace/browser-profiles/clawemail-dashboard-persistent
|
||||
CDP port: 9224
|
||||
```
|
||||
|
||||
Dashboard API base:
|
||||
|
||||
```text
|
||||
https://claw.163.com/mailserv-claw-dashboard
|
||||
```
|
||||
|
||||
Permission update API:
|
||||
|
||||
```text
|
||||
POST /api/v1/mailboxes/comm-settings?id=<mailboxId>
|
||||
body: {"commLevel":2,"extReceiveType":1,"extSendType":0}
|
||||
```
|
||||
|
||||
Verification command:
|
||||
|
||||
```bash
|
||||
mail-cli clawemail info --uid <submailbox> --json
|
||||
```
|
||||
|
||||
Expected values:
|
||||
|
||||
```text
|
||||
commLevel=2
|
||||
extReceiveType=1
|
||||
```
|
||||
|
||||
This has been added as a mandatory gate: after creating a ClawEmail sub-mailbox, immediately enable/verify external receive before submitting the mailbox to OpenAI.
|
||||
|
||||
## OpenAI registration and email verification
|
||||
|
||||
The fresh mailbox successfully reached and passed OpenAI email verification after the ClawEmail receive permission was corrected.
|
||||
|
||||
The flow can reliably reach:
|
||||
|
||||
```text
|
||||
https://auth.openai.com/add-phone
|
||||
```
|
||||
|
||||
If OpenAI auth/session becomes broken or phone verification navigation returns a Chrome/OpenAI error page, recovery is to generate a new Codex2API OAuth URL and log in with the same verified email/password; it returns to `add-phone`.
|
||||
|
||||
## Strict phone country/area-code gate
|
||||
|
||||
A bug occurred where an Indonesia 5sim number was submitted while the OpenAI page selector had silently reverted to `美国 (+1)`. That invalid attempt was canceled and excluded.
|
||||
|
||||
Mandatory gate now implemented:
|
||||
|
||||
1. Before buying a 5sim number, verify:
|
||||
- native `select.value` equals target ISO;
|
||||
- visible country text equals expected country/dial code.
|
||||
2. After filling the number and immediately before clicking Continue, verify the same two conditions again.
|
||||
3. If either check fails:
|
||||
- do not click Continue;
|
||||
- cancel any just-bought activation;
|
||||
- reset selector and retry.
|
||||
|
||||
Known mappings:
|
||||
|
||||
| 5sim country | OpenAI ISO | Visible text | Prefix |
|
||||
| --- | --- | --- | --- |
|
||||
| `argentina` | `AR` | `阿根廷 (+54)` | `54` |
|
||||
| `netherlands` | `NL` | `荷兰 (+31)` | `31` |
|
||||
| `indonesia` | `ID` | `印度尼西亚 (+62)` | `62` |
|
||||
| `england` | `GB` | `英国 (+44)` | `44` |
|
||||
|
||||
Reliable selector set:
|
||||
|
||||
```js
|
||||
const sel = document.querySelector('select');
|
||||
sel.focus();
|
||||
sel.value = 'GB';
|
||||
sel.dispatchEvent(new Event('input', { bubbles: true }));
|
||||
sel.dispatchEvent(new Event('change', { bubbles: true }));
|
||||
await new Promise(r => setTimeout(r, 800));
|
||||
```
|
||||
|
||||
Gate check:
|
||||
|
||||
```js
|
||||
const visibleCountry = [...document.querySelectorAll('button')]
|
||||
.map(b => b.innerText)
|
||||
.find(t => /\(\+\d+\)/.test(t));
|
||||
const selectValue = document.querySelector('select')?.value;
|
||||
```
|
||||
|
||||
## Phone-verification attempts completed
|
||||
|
||||
All phone attempts used 5sim SMS activation for `openai`, not WhatsApp.
|
||||
|
||||
### Earlier country-order run
|
||||
|
||||
Configured order at that time:
|
||||
|
||||
```text
|
||||
argentina -> netherlands -> indonesia
|
||||
```
|
||||
|
||||
Results:
|
||||
|
||||
| Country | Activation IDs observed | Result |
|
||||
| --- | --- | --- |
|
||||
| Argentina | `1006713742`, `1006724245` and additional strict-run attempts | OpenAI accepted/waited, no SMS after polling/resend; orders canceled. |
|
||||
| Netherlands | `1006714867`, `1006733450` and additional strict-run attempts | OpenAI accepted/waited, no SMS after polling/resend; orders canceled. |
|
||||
| Indonesia | `1006715764`, `1006722837` | Correct `+62` attempt received no SMS after polling/resend; orders canceled. |
|
||||
|
||||
Invalid/corrected attempt:
|
||||
|
||||
- `1006721757` was bought for Indonesia but page was still `美国 (+1)`, so it was canceled and excluded.
|
||||
|
||||
### United Kingdom +44 run
|
||||
|
||||
BOSS requested switching to UK +44.
|
||||
|
||||
Config was changed to:
|
||||
|
||||
```text
|
||||
FIVE_SIM_COUNTRY_ORDER=england
|
||||
PHONE_VERIFICATION_REPLACEMENT_LIMIT=10
|
||||
```
|
||||
|
||||
OpenAI country gate confirmed:
|
||||
|
||||
```text
|
||||
英国 (+44)
|
||||
selectValue=GB
|
||||
```
|
||||
|
||||
UK run outcome:
|
||||
|
||||
- Attempts: 10
|
||||
- Last activation ID: `1006738454`
|
||||
- Result: all attempts reached waiting/phone-verification state, but 5sim SMS stayed `RECEIVED` with `sms_count=0` through initial polling and after resend; every order was canceled.
|
||||
- Final phase: `phone_failed_all`
|
||||
|
||||
## Official extension update learned
|
||||
|
||||
Official repo inspected:
|
||||
|
||||
```text
|
||||
https://github.com/QLHazyCoder/codex-oauth-automation-extension
|
||||
local old: 7dc5cf2
|
||||
upstream latest inspected: 6bd00db
|
||||
```
|
||||
|
||||
Relevant changed files:
|
||||
|
||||
- `background/phone-verification-flow.js`
|
||||
- `content/phone-auth.js`
|
||||
- `phone-sms/providers/five-sim.js`
|
||||
- `tests/phone-auth-country-match.test.js`
|
||||
- `tests/phone-verification-flow.test.js`
|
||||
|
||||
Adopted improvements:
|
||||
|
||||
1. Probe resend channel before clicking.
|
||||
- Detect `whatsapp`, `sms`, or `unknown` using button `value`, `aria-label`, `title`, `innerText`, `textContent`.
|
||||
- If WhatsApp is detected and policy is SMS-only, cancel current SMS activation and do not click resend.
|
||||
2. Classify HTTP 500/contact-verification pages.
|
||||
- Match `This page isn’t working`, `currently unable to handle this request`, `HTTP ERROR 500`, `500 Internal Server Error`.
|
||||
- Cancel current activation and recover back to `add-phone`.
|
||||
3. Broaden direct-delivery-refused detection.
|
||||
- Match Chinese/English variants of `无法向此电话号码发送验证码` / cannot send SMS/text/code to this number.
|
||||
4. Add UK mapping.
|
||||
- 5sim: `england`; OpenAI: `GB`, `英国 (+44)`, prefix `44`.
|
||||
5. Add stale `/email-verification` guard.
|
||||
- If the phone flow unexpectedly returns to email verification, stop and do not burn more phone activations.
|
||||
6. Emit compact waiting/polling JSONL so long waits are visible without dumping DOM.
|
||||
|
||||
Local runner patched:
|
||||
|
||||
```text
|
||||
/tmp/phone_verify_strict_gate_10.py
|
||||
```
|
||||
|
||||
Persistent skill references added:
|
||||
|
||||
- `references/openai-add-phone-strict-country-gate-2026-05-10.md`
|
||||
- `references/official-extension-phone-update-2026-05-10.md`
|
||||
- `references/openai-1085-clawemail-permission-phone-results-2026-05-10.md`
|
||||
|
||||
## Current conclusion
|
||||
|
||||
The non-phone parts are now repeatable:
|
||||
|
||||
```text
|
||||
Create ClawEmail sub-mailbox
|
||||
-> enable external receive
|
||||
-> Codex2API OAuth
|
||||
-> OpenAI register/login
|
||||
-> email verification
|
||||
-> add-phone
|
||||
```
|
||||
|
||||
Phone verification remains blocked. Tested SMS-only countries/regions all failed to receive SMS through 5sim:
|
||||
|
||||
```text
|
||||
Argentina
|
||||
Netherlands
|
||||
Indonesia
|
||||
United Kingdom +44
|
||||
```
|
||||
|
||||
Observed common pattern:
|
||||
|
||||
```text
|
||||
OpenAI may accept the phone and show phone-verification/waiting state,
|
||||
but 5sim SMS activation receives no code even after resend.
|
||||
```
|
||||
|
||||
Some pages/resend controls may indicate WhatsApp delivery. Under BOSS's SMS-only policy, the runner must not click WhatsApp resend or switch to WhatsApp receiving automatically.
|
||||
|
||||
## Recommended next experiments
|
||||
|
||||
1. Try a different SMS provider supported by the official extension, such as HeroSMS or NexSMS, while staying SMS-only.
|
||||
2. Try countries from the official HeroSMS prefix hints: Thailand `+66`, Vietnam `+84`, Japan `+81`, Germany `+49`, France `+33`, USA `+1` only if BOSS approves.
|
||||
3. Keep the strict country gate and resend-channel probe in all future runs.
|
||||
4. If OpenAI explicitly selects WhatsApp delivery and BOSS still requires SMS-only, stop early before buying SMS numbers.
|
||||
Reference in New Issue
Block a user