# Codex OAuth onboarding status summary (2026-05-10)

This document consolidates the current Hermes-driven Codex2API/OpenAI OAuth onboarding findings, local automation changes, and failed phone-verification attempts. Secrets, full proxy strings, passwords, API keys, full phone numbers, and callback URLs are intentionally omitted.

## Current objective

Run a single OpenAI/Codex OAuth registration/onboarding flow through Codex2API using:

- fresh ClawEmail sub-mailbox;
- 1085 proxy/browser profile;
- OpenAI email verification;
- OpenAI add-phone phone verification;
- 5sim SMS activation only, not WhatsApp.

## Stable environment facts

- Codex2API OAuth target is configured in `~/.hermes/env/codex_oauth_onboarding.env`.
- 5sim provider is configured for SMS activation:
  - `PHONE_SMS_PROVIDER=5sim`
  - `FIVE_SIM_OPERATOR=any`
  - `FIVE_SIM_PRODUCT=openai`
  - `FIVE_SIM_SERVICE=openai`
- The original 5sim activation endpoint shape remains:
  - `/v1/user/buy/activation/{country}/any/openai`
- BOSS requested SMS-only. Do not switch to WhatsApp providers unless BOSS explicitly approves.

## ClawEmail mailbox and permission flow

Old sub-mailboxes were deleted to clear quota.

Fresh mailbox created:

```text
chickliu.wnjmwncq@claw.163.com
```

Important ClawEmail discovery:

- Newly-created sub-mailboxes defaulted to internal-only receive:
  - `commLevel=1`
  - `extReceiveType=0`
- OpenAI verification emails do not arrive until external receive is enabled.

Persistent ClawEmail Dashboard browser profile:

```text
/Users/chick/.Hermes/workspace/browser-profiles/clawemail-dashboard-persistent
CDP port: 9224
```

Dashboard API base:

```text
https://claw.163.com/mailserv-claw-dashboard
```

Permission update API:

```text
POST /api/v1/mailboxes/comm-settings?id=<mailboxId>
body: {"commLevel":2,"extReceiveType":1,"extSendType":0}
```

Verification command:

```bash
mail-cli clawemail info --uid <submailbox> --json
```

Expected values:

```text
commLevel=2
extReceiveType=1
```

This has been added as a mandatory gate: after creating a ClawEmail sub-mailbox, immediately enable/verify external receive before submitting the mailbox to OpenAI.

## OpenAI registration and email verification

The fresh mailbox successfully reached and passed OpenAI email verification after the ClawEmail receive permission was corrected.

The flow can reliably reach:

```text
https://auth.openai.com/add-phone
```

If OpenAI auth/session becomes broken or phone verification navigation returns a Chrome/OpenAI error page, recovery is to generate a new Codex2API OAuth URL and log in with the same verified email/password; it returns to `add-phone`.

## Strict phone country/area-code gate

A bug occurred where an Indonesia 5sim number was submitted while the OpenAI page selector had silently reverted to `美国 (+1)`. That invalid attempt was canceled and excluded.

Mandatory gate now implemented:

1. Before buying a 5sim number, verify:
   - native `select.value` equals target ISO;
   - visible country text equals expected country/dial code.
2. After filling the number and immediately before clicking Continue, verify the same two conditions again.
3. If either check fails:
   - do not click Continue;
   - cancel any just-bought activation;
   - reset selector and retry.

Known mappings:

| 5sim country | OpenAI ISO | Visible text | Prefix |
| --- | --- | --- | --- |
| `argentina` | `AR` | `阿根廷 (+54)` | `54` |
| `netherlands` | `NL` | `荷兰 (+31)` | `31` |
| `indonesia` | `ID` | `印度尼西亚 (+62)` | `62` |
| `england` | `GB` | `英国 (+44)` | `44` |

Reliable selector set:

```js
const sel = document.querySelector('select');
sel.focus();
sel.value = 'GB';
sel.dispatchEvent(new Event('input', { bubbles: true }));
sel.dispatchEvent(new Event('change', { bubbles: true }));
await new Promise(r => setTimeout(r, 800));
```

Gate check:

```js
const visibleCountry = [...document.querySelectorAll('button')]
  .map(b => b.innerText)
  .find(t => /\(\+\d+\)/.test(t));
const selectValue = document.querySelector('select')?.value;
```

## Phone-verification attempts completed

All phone attempts used 5sim SMS activation for `openai`, not WhatsApp.

### Earlier country-order run

Configured order at that time:

```text
argentina -> netherlands -> indonesia
```

Results:

| Country | Activation IDs observed | Result |
| --- | --- | --- |
| Argentina | `1006713742`, `1006724245` and additional strict-run attempts | OpenAI accepted/waited, no SMS after polling/resend; orders canceled. |
| Netherlands | `1006714867`, `1006733450` and additional strict-run attempts | OpenAI accepted/waited, no SMS after polling/resend; orders canceled. |
| Indonesia | `1006715764`, `1006722837` | Correct `+62` attempt received no SMS after polling/resend; orders canceled. |

Invalid/corrected attempt:

- `1006721757` was bought for Indonesia but page was still `美国 (+1)`, so it was canceled and excluded.

### United Kingdom +44 run

BOSS requested switching to UK +44.

Config was changed to:

```text
FIVE_SIM_COUNTRY_ORDER=england
PHONE_VERIFICATION_REPLACEMENT_LIMIT=10
```

OpenAI country gate confirmed:

```text
英国 (+44)
selectValue=GB
```

UK run outcome:

- Attempts: 10
- Last activation ID: `1006738454`
- Result: all attempts reached waiting/phone-verification state, but 5sim SMS stayed `RECEIVED` with `sms_count=0` through initial polling and after resend; every order was canceled.
- Final phase: `phone_failed_all`

## Official extension update learned

Official repo inspected:

```text
https://github.com/QLHazyCoder/codex-oauth-automation-extension
local old: 7dc5cf2
upstream latest inspected: 6bd00db
```

Relevant changed files:

- `background/phone-verification-flow.js`
- `content/phone-auth.js`
- `phone-sms/providers/five-sim.js`
- `tests/phone-auth-country-match.test.js`
- `tests/phone-verification-flow.test.js`

Adopted improvements:

1. Probe resend channel before clicking.
   - Detect `whatsapp`, `sms`, or `unknown` using button `value`, `aria-label`, `title`, `innerText`, `textContent`.
   - If WhatsApp is detected and policy is SMS-only, cancel current SMS activation and do not click resend.
2. Classify HTTP 500/contact-verification pages.
   - Match `This page isn’t working`, `currently unable to handle this request`, `HTTP ERROR 500`, `500 Internal Server Error`.
   - Cancel current activation and recover back to `add-phone`.
3. Broaden direct-delivery-refused detection.
   - Match Chinese/English variants of `无法向此电话号码发送验证码` / cannot send SMS/text/code to this number.
4. Add UK mapping.
   - 5sim: `england`; OpenAI: `GB`, `英国 (+44)`, prefix `44`.
5. Add stale `/email-verification` guard.
   - If the phone flow unexpectedly returns to email verification, stop and do not burn more phone activations.
6. Emit compact waiting/polling JSONL so long waits are visible without dumping DOM.

Local runner patched:

```text
/tmp/phone_verify_strict_gate_10.py
```

Persistent skill references added:

- `references/openai-add-phone-strict-country-gate-2026-05-10.md`
- `references/official-extension-phone-update-2026-05-10.md`
- `references/openai-1085-clawemail-permission-phone-results-2026-05-10.md`

## Current conclusion

The non-phone parts are now repeatable:

```text
Create ClawEmail sub-mailbox
-> enable external receive
-> Codex2API OAuth
-> OpenAI register/login
-> email verification
-> add-phone
```

Phone verification remains blocked. Tested SMS-only countries/regions all failed to receive SMS through 5sim:

```text
Argentina
Netherlands
Indonesia
United Kingdom +44
```

Observed common pattern:

```text
OpenAI may accept the phone and show phone-verification/waiting state,
but 5sim SMS activation receives no code even after resend.
```

Some pages/resend controls may indicate WhatsApp delivery. Under BOSS's SMS-only policy, the runner must not click WhatsApp resend or switch to WhatsApp receiving automatically.

## Recommended next experiments

1. Try a different SMS provider supported by the official extension, such as HeroSMS or NexSMS, while staying SMS-only.
2. Try countries from the official HeroSMS prefix hints: Thailand `+66`, Vietnam `+84`, Japan `+81`, Germany `+49`, France `+33`, USA `+1` only if BOSS approves.
3. Keep the strict country gate and resend-channel probe in all future runs.
4. If OpenAI explicitly selects WhatsApp delivery and BOSS still requires SMS-only, stop early before buying SMS numbers.