Warn when Codex uses auto under AWF API proxy - #7818
Conversation
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
auto under AWF API proxy
There was a problem hiding this comment.
Pull request overview
Adds an actionable warning and guidance for Codex auto failures under AWF API-key routing.
Changes:
- Detects Codex
autoduring agent startup. - Documents explicit-model configuration.
- Adds shell-test coverage for warning behavior.
Show a summary per file
| File | Description |
|---|---|
containers/agent/entrypoint.sh |
Adds the startup warning. |
tests/entrypoint-phase-functions.test.sh |
Tests warning output. |
docs/api-proxy-sidecar.md |
Updates the Codex example. |
docs/troubleshooting.md |
Adds failure guidance. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Suppressed comments (2)
containers/agent/entrypoint.sh:428
- The suggested model is rejected by this same API proxy:
containers/api-proxy/guards/retired-model-guard.js:18-20marksgpt-5-codexas retired and returnsgpt-5.3-codexas its replacement. Following this warning would trade theautofailure for a guaranteed 400 response.
echo "[entrypoint][WARN] Set an explicit Codex model in workflow frontmatter (for example, model: gpt-5-codex) before running under AWF."
docs/api-proxy-sidecar.md:104
- The recommended explicit model is retired and blocked by AWF's API proxy (
containers/api-proxy/guards/retired-model-guard.js:18-20), so this guidance leads users directly to another model error. Recommend the guard's supported replacement instead.
When Codex runs through the AWF API proxy, use an explicit model such as
`gpt-5-codex`. Codex's `auto` model alias depends on ChatGPT-authenticated
- Files reviewed: 4/4 changed files
- Comments generated: 3
- Review effort level: Balanced
| if [ -z "${AWF_API_PROXY_IP:-}" ]; then | ||
| return |
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Addressed in commit |
|
✅ Copilot review passed with no inline comments. @copilot Add the |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Security Guard completed successfully! PR #7818 security review complete: No security-weakening changes found. The new
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✅ Contribution Check completed successfully! PR review complete: the change includes code, docs, and a targeted shell test for the new Codex auto-model warning, and the PR description references the related issue. No contribution-guideline issues found that require comment.
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
✅ Smoke Claude passed
|
Smoke Test: Copilot Engine — PASS ✅
Overall: PASS cc
|
Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) with api-proxy sidecar handling real credentials.
|
github-actions
Bot
added
smoke-copilot-byok
smoke-copilot-network-isolation
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable — Overall: PASS cc Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
Smoke test: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
|
Smoke test: GitHub Actions services connectivity
Overall: FAIL —
|
Smoke Test: Docker Sbx Validation
Overall: PASS cc
|
|
OTel Tracing Smoke Test Results
All 5 scenarios pass. No regressions detected in OTel tracing integration.
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
Chroot Version Comparison Results
Result: Not all tests passed — Node.js version mismatch detected inside the chroot environment (host reports v24.19.0, chroot reports v2.97.0).
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: Java's default
|
|
Smoke Test Results:
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) Overall: PASS
|
|
Smoke Test Results: Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) via Entra
|
Codex
automodel resolution depends on ChatGPT-authenticated remote model/plugin metadata, but AWF routes Codex through API-key-based proxy auth. Even withchatgpt.comallowed,autocan fail withThe requested model is not supported.Agent startup warning
codex+GH_AW_MODEL_AGENT_CODEX=autowhen AWF API proxy routing is active.Docs
Unknown model auto is used/model_not_supportedfailures.Coverage
autounder API proxy routing.Example:
npx @openai/codex --model gpt-5-codex -p "write a hello world function"