From a8ce7ae9e918014ed42309acd1cefde06dfa783c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 04:10:25 +0000 Subject: [PATCH 1/3] Initial plan From 1ca452f03ea9823b273b984b1ea8f686de992899 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 04:16:38 +0000 Subject: [PATCH 2/3] fix: warn about codex auto model in api proxy Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --- containers/agent/entrypoint.sh | 21 ++++++++++++ docs/api-proxy-sidecar.md | 8 ++++- docs/troubleshooting.md | 16 +++++++++ tests/entrypoint-phase-functions.test.sh | 42 ++++++++++++++++++++++++ 4 files changed, 86 insertions(+), 1 deletion(-) diff --git a/containers/agent/entrypoint.sh b/containers/agent/entrypoint.sh index bf8f256de..ce42a75b4 100644 --- a/containers/agent/entrypoint.sh +++ b/containers/agent/entrypoint.sh @@ -410,6 +410,26 @@ GRADLE_EOF fi } +warn_codex_auto_model() { +if [ -z "${AWF_API_PROXY_IP:-}" ]; then + return +fi + +local CODEX_MODEL="${GH_AW_MODEL_AGENT_CODEX:-}" +if [ -z "${CODEX_MODEL}" ]; then + return +fi + +local ENGINE_NAME="${GH_AW_AWF_ENGINE_NAME:-${GH_AW_ENGINE_ID:-}}" +case "${ENGINE_NAME}:${CODEX_MODEL}" in + [Cc][Oo][Dd][Ee][Xx]:[Aa][Uu][Tt][Oo]) + echo "[entrypoint][WARN] Codex model 'auto' is not supported with AWF api-proxy/API-key routing." + echo "[entrypoint][WARN] Codex resolves 'auto' through ChatGPT-authenticated remote model metadata; API-key auth cannot access that catalog." + echo "[entrypoint][WARN] Set an explicit Codex model in workflow frontmatter (for example, model: gpt-5-codex) before running under AWF." + ;; +esac +} + log_environment_details() { # Print proxy environment echo "[entrypoint] Proxy configuration:" @@ -1673,6 +1693,7 @@ wait_for_iptables check_service_health configure_claude_api_key configure_jvm_proxy +warn_codex_auto_model log_environment_details determine_capabilities_to_drop log_execution_context "$@" diff --git a/docs/api-proxy-sidecar.md b/docs/api-proxy-sidecar.md index 08810a7c0..35429d513 100644 --- a/docs/api-proxy-sidecar.md +++ b/docs/api-proxy-sidecar.md @@ -95,11 +95,17 @@ export OPENAI_API_KEY="sk-..." sudo awf \ --allow-domains api.openai.com \ - -- npx @openai/codex -p "write a hello world function" + -- npx @openai/codex --model gpt-5-codex -p "write a hello world function" ``` The agent container automatically uses `http://172.30.0.30:10000` as the OpenAI base URL. +When Codex runs through the AWF API proxy, use an explicit model such as +`gpt-5-codex`. Codex's `auto` model alias depends on ChatGPT-authenticated +remote model/plugin metadata resolution; API-key based proxy routing cannot use +that catalog even when `chatgpt.com` is allowed, so `auto` can fail with +`The requested model is not supported`. + ### Claude Code example ```bash diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index bec7ed96c..b396e29bc 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -147,6 +147,22 @@ ``` 4. Review [GitHub Enterprise Configuration](enterprise-configuration.md) for the expected endpoint derivation and allowlist behavior. +### Codex `auto` Model Fails Under AWF + +**Problem:** A Codex run inside AWF fails with messages such as: +- `Unknown model auto is used` +- `The requested model is not supported` +- `chatgpt authentication required for remote plugin catalog; api key auth is not supported` + +**Cause:** Codex's `auto` model alias relies on ChatGPT-authenticated remote +model/plugin metadata. AWF's API proxy uses API-key credential injection, so the +ChatGPT catalog lookup cannot be used even if `chatgpt.com` is on the network +allowlist. + +**Solution:** Set an explicit Codex model instead of `auto`, for example +`model: gpt-5-codex` in workflow frontmatter or `codex exec --model +gpt-5-codex ...` for direct CLI usage. + ## Permission Issues ### iptables Permission Denied diff --git a/tests/entrypoint-phase-functions.test.sh b/tests/entrypoint-phase-functions.test.sh index e1a416b32..0cf68f11d 100755 --- a/tests/entrypoint-phase-functions.test.sh +++ b/tests/entrypoint-phase-functions.test.sh @@ -23,6 +23,7 @@ required_functions=( check_service_health configure_claude_api_key configure_jvm_proxy + warn_codex_auto_model log_environment_details determine_capabilities_to_drop log_execution_context @@ -75,6 +76,7 @@ required_calls=( 'check_service_health' 'configure_claude_api_key' 'configure_jvm_proxy' + 'warn_codex_auto_model' 'log_environment_details' 'determine_capabilities_to_drop' 'log_execution_context "$@"' @@ -263,6 +265,46 @@ else fail "configure_jvm_proxy() aborts when .m2/.gradle exist on a read-only home" fi +run_warn_codex_auto_model_fixture() { + local output + output="$( + env \ + AWF_API_PROXY_IP="172.30.0.30" \ + GH_AW_AWF_ENGINE_NAME="codex" \ + GH_AW_MODEL_AGENT_CODEX="auto" \ + bash -c ' + . "$1" + warn_codex_auto_model + ' _ "${ENTRYPOINT}" 2>&1 + )" + case "${output}" in + *"Codex model 'auto' is not supported with AWF api-proxy/API-key routing."*\ +*"Set an explicit Codex model in workflow frontmatter"*) + ;; + *) + return 1 + ;; + esac + + output="$( + env \ + AWF_API_PROXY_IP="172.30.0.30" \ + GH_AW_AWF_ENGINE_NAME="codex" \ + GH_AW_MODEL_AGENT_CODEX="gpt-5-codex" \ + bash -c ' + . "$1" + warn_codex_auto_model + ' _ "${ENTRYPOINT}" 2>&1 + )" + [ -z "${output}" ] +} + +if run_warn_codex_auto_model_fixture; then + pass "warn_codex_auto_model() warns only for codex model auto under api-proxy" +else + fail "warn_codex_auto_model() did not warn correctly for codex model auto under api-proxy" +fi + echo "" echo "Results: ${PASS} passed, ${FAIL} failed" From 493f66f30ac7c614e5261fa987ae8a828e76ef55 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 28 Aug 2026 04:37:39 +0000 Subject: [PATCH 3/3] fix: gate Codex auto warning on OpenAI proxy Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --- containers/agent/entrypoint.sh | 2 +- docs/api-proxy-sidecar.md | 4 ++-- docs/troubleshooting.md | 4 ++-- tests/entrypoint-phase-functions.test.sh | 13 +++++++++++++ 4 files changed, 18 insertions(+), 5 deletions(-) diff --git a/containers/agent/entrypoint.sh b/containers/agent/entrypoint.sh index ce42a75b4..7d39dcb3a 100644 --- a/containers/agent/entrypoint.sh +++ b/containers/agent/entrypoint.sh @@ -411,7 +411,7 @@ fi } warn_codex_auto_model() { -if [ -z "${AWF_API_PROXY_IP:-}" ]; then +if [ -z "${OPENAI_BASE_URL:-}" ]; then return fi diff --git a/docs/api-proxy-sidecar.md b/docs/api-proxy-sidecar.md index 35429d513..eab031de8 100644 --- a/docs/api-proxy-sidecar.md +++ b/docs/api-proxy-sidecar.md @@ -95,13 +95,13 @@ export OPENAI_API_KEY="sk-..." sudo awf \ --allow-domains api.openai.com \ - -- npx @openai/codex --model gpt-5-codex -p "write a hello world function" + -- npx @openai/codex --model gpt-5.3-codex -p "write a hello world function" ``` The agent container automatically uses `http://172.30.0.30:10000` as the OpenAI base URL. When Codex runs through the AWF API proxy, use an explicit model such as -`gpt-5-codex`. Codex's `auto` model alias depends on ChatGPT-authenticated +`gpt-5.3-codex`. Codex's `auto` model alias depends on ChatGPT-authenticated remote model/plugin metadata resolution; API-key based proxy routing cannot use that catalog even when `chatgpt.com` is allowed, so `auto` can fail with `The requested model is not supported`. diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index b396e29bc..c4292f9fd 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -160,8 +160,8 @@ ChatGPT catalog lookup cannot be used even if `chatgpt.com` is on the network allowlist. **Solution:** Set an explicit Codex model instead of `auto`, for example -`model: gpt-5-codex` in workflow frontmatter or `codex exec --model -gpt-5-codex ...` for direct CLI usage. +`model: gpt-5.3-codex` in workflow frontmatter or `codex exec --model +gpt-5.3-codex ...` for direct CLI usage. ## Permission Issues diff --git a/tests/entrypoint-phase-functions.test.sh b/tests/entrypoint-phase-functions.test.sh index 0cf68f11d..7f839238d 100755 --- a/tests/entrypoint-phase-functions.test.sh +++ b/tests/entrypoint-phase-functions.test.sh @@ -270,6 +270,7 @@ run_warn_codex_auto_model_fixture() { output="$( env \ AWF_API_PROXY_IP="172.30.0.30" \ + OPENAI_BASE_URL="http://172.30.0.30:10000" \ GH_AW_AWF_ENGINE_NAME="codex" \ GH_AW_MODEL_AGENT_CODEX="auto" \ bash -c ' @@ -297,6 +298,18 @@ run_warn_codex_auto_model_fixture() { ' _ "${ENTRYPOINT}" 2>&1 )" [ -z "${output}" ] + + output="$( + env \ + AWF_API_PROXY_IP="172.30.0.30" \ + GH_AW_AWF_ENGINE_NAME="codex" \ + GH_AW_MODEL_AGENT_CODEX="auto" \ + bash -c ' + . "$1" + warn_codex_auto_model + ' _ "${ENTRYPOINT}" 2>&1 + )" + [ -z "${output}" ] } if run_warn_codex_auto_model_fixture; then