[awf] agent: codex engine "auto" model not recognized when running inside AWF sandbox

[lpcox]

Problem
Duplicate Code Detector workflow using the codex engine failed inside the AWF sandbox with Unknown model auto is used and The requested model is not supported, terminating the engine.

Context
github/gh-aw#56462 (run: https://github.com/github/gh-aw/actions/runs/33130520476)

Root Cause
The codex engine's auto model alias apparently requires ChatGPT-authenticated remote plugin/model metadata resolution, which fails under API-key auth used inside the AWF sandbox network (chatgpt authentication required for remote plugin catalog; api key auth is not supported). Because outbound codex traffic is routed through AWF's api-proxy/Squid, remote plugin catalog calls needed to resolve auto may be blocked or unsupported for this auth mode, unlike direct execution.

Proposed Solution

• Verify whether containers/api-proxy allowlists the codex plugin-catalog/model endpoints, or if API-key auth mode simply doesn't support auto regardless of network path.
• If it's a firewall/proxy allow-list gap, add the missing chatgpt.com/plugin-catalog endpoints to the Squid ACL for codex sessions.
• If unrelated to AWF, document that AWF-wrapped codex runs must set an explicit model: (not auto) in workflow frontmatter, and add a startup check/warning in entrypoint.sh or docs.

Generated by Firewall Issue Dispatcher · copilot · auto · 25.2 AIC · ⊞ 9.4K · ◷