codex-oauth-plus-onboarding-skill/skill/codex-oauth-plus-onboarding/references/openai-login-recovery-gate-before-phone-runs-2026-05-10.md

OpenAI login recovery gate before phone/SMS runs (2026-05-10)

Trigger

Use this note before any new country-specific OpenAI phone-verification run, especially when BOSS asks to test a new 5sim country such as Chile.

Incident

BOSS requested testing Chile numbers 5 times.

Intended mapping:

5sim country: chile
OpenAI ISO: CL
Visible selector: 智利 (+56)
Dial prefix: 56
Total attempts: 5

Two blockers appeared before any 5sim number was bought:

1. The generated Chile runner still read FIVE_SIM_COUNTRY_ORDER from env, so it started with the old Europe list (italy,poland,spain,england) instead of chile.
2. OpenAI account recovery could not return to add-phone:
   • Password login showed Incorrect email address or password.
   • Clicking 使用一次性验证码登录 returned invalid_state.
   • Fresh Codex2API OAuth URLs plus stale-tab cleanup still landed on the password page/error state.

Because the runner failed before add-phone, no Chile 5sim activation was bought and no number was submitted.

Rule

Before buying any 5sim activation for a new country, enforce a hard pre-buy gate:

current URL must be https://auth.openai.com/add-phone
OpenAI account must already be usable / email-verified
country selector can be set and read back for the target country

If the page is any of the following, stop before buying numbers:

/auth.openai.com/log-in/password
Incorrect email address or password
invalid_state
account_deactivated
email-verification stale state

Runner implementation guard

Country-specific test runners must not accidentally read a stale env country order.

For one-off country tests, explicitly set:

ORDER = ['chile']  # or requested country only
LIMIT = 5          # requested total/per-country budget

Also emit the effective order at startup and verify it matches the request before attempting OAuth recovery:

{"phase":"phone_strict_start","countries":["chile"],"max_total_attempts":5}

If startup emits a different country list than requested, abort immediately rather than buying or submitting any number.

Recovery recommendation

When login recovery fails with password mismatch plus invalid_state, do not keep generating OAuth URLs in a loop. The next step should be one of:

1. create a fresh ClawEmail sub-mailbox and restart the OpenAI account flow;
2. manually verify/reset the account password;
3. manually test visible browser 使用一次性验证码登录 once to confirm whether invalid_state persists.

Only resume 5sim phone attempts after add-phone is restored.