Invalid Value: 'tools'. Function 'functions.followup_task' declares encrypted parameters but is not configured for encrypted tool use by this model.
Open 💬 10 comments Opened Jun 9, 2026 by cowwoc
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
What version of Codex CLI is running?
codex-cli 0.138.0
What subscription do you have?
Pro 20x
Which model were you using?
gpt-5.4
What platform is your computer?
Linux 6.6.114.1-microsoft-standard-WSL2 x86_64 x86_64
What terminal emulator and version are you using (if applicable)?
Windows Terminal
Codex doctor report
{
"schemaVersion": 1,
"generatedAt": "1781019894s since unix epoch",
"overallStatus": "warning",
"codexVersion": "0.138.0",
"checks": {
"app_server.status": {
"id": "app_server.status",
"category": "app-server",
"status": "ok",
"summary": "background server is not running",
"details": {
"control socket": "/home/node/.codex/app-server-control/app-server-control.sock",
"daemon state dir": "/home/node/.codex/app-server-daemon",
"mode": "ephemeral",
"pid file": "/home/node/.codex/app-server-daemon/app-server.pid (missing)",
"settings": "/home/node/.codex/app-server-daemon/settings.json (missing)",
"status": "not running",
"update-loop pid file": "/home/node/.codex/app-server-daemon/app-server-updater.pid (missing)"
},
"remediation": null,
"durationMs": 0
},
"auth.credentials": {
"id": "auth.credentials",
"category": "auth",
"status": "ok",
"summary": "auth is configured",
"details": {
"auth env vars present": "OPENAI_API_KEY",
"auth file": "/home/node/.codex/auth.json",
"auth storage mode": "File",
"stored API key": "true",
"stored ChatGPT tokens": "false",
"stored agent identity": "false",
"stored auth mode": "api_key"
},
"remediation": null,
"durationMs": 0
},
"config.load": {
"id": "config.load",
"category": "config",
"status": "ok",
"summary": "config loaded",
"details": {
"CODEX_HOME": "/home/node/.codex",
"config.toml": "/home/node/.codex/config.toml",
"config.toml parse": "ok",
"cwd": "/workspace",
"enabled feature flags": "shell_tool, unified_exec, shell_snapshot, terminal_resize_reflow, sqlite, enable_request_compression, multi_agent, multi_agent_v2, apps, tool_suggest, plugins, in_app_browser, browser_use, browser_use_external, computer_use, plugin_sharing, image_generation, skill_mcp_dependency_install, steer, guardian_approval, goals, collaboration_modes, tool_call_mcp_elicitation, personality, fast_mode, tui_app_server, prevent_idle_sleep, workspace_dependencies",
"feature flag overrides": "hooks=false, multi_agent_v2=true, prevent_idle_sleep=true",
"feature flags enabled": "28",
"log dir": "/home/node/.codex/log",
"mcp servers": "0",
"model": "gpt-5.4",
"model provider": "openai",
"sqlite home": "/home/node/.codex"
},
"remediation": null,
"durationMs": 0
},
"git.environment": {
"id": "git.environment",
"category": "git",
"status": "ok",
"summary": "git version 2.47.3",
"details": {
".git entry": "directory",
"PATH git #1": "/usr/bin/git",
"PATH git #2": "/bin/git",
"PATH git entries": "2",
"git branch": "v2.1",
"git build options": "git version 2.47.3; cpu: x86_64; no commit associated with this build; sizeof-long: 8; sizeof-size_t: 8; shell-path: /bin/sh; libcurl: 8.14.1; zlib: 1.3.1",
"git exec path": "/usr/lib/git-core",
"git version": "git version 2.47.3",
"repo detected": "true",
"repo root": "/workspace",
"selected git": "/usr/bin/git"
},
"remediation": null,
"durationMs": 17
},
"installation": {
"id": "installation",
"category": "install",
"status": "ok",
"summary": "installation looks consistent",
"details": {
"PATH codex #1": "/usr/local/bin/codex",
"PATH codex #2": "/usr/local/share/npm-global/bin/codex",
"PATH codex entries": "2",
"current executable": "/usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex",
"install context": "npm (package /usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl, bin /usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin, resources /usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-resources, path /usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-path)",
"managed by bun": "false",
"managed by npm": "true",
"managed package root": "/usr/local/share/npm-global/lib/node_modules/@openai/codex",
"npm update target": "/usr/local/share/npm-global/lib/node_modules/@openai/codex"
},
"remediation": null,
"durationMs": 112
},
"mcp.config": {
"id": "mcp.config",
"category": "mcp",
"status": "ok",
"summary": "no MCP servers configured",
"details": {},
"remediation": null,
"durationMs": 0
},
"network.env": {
"id": "network.env",
"category": "network",
"status": "ok",
"summary": "network-related environment looks readable",
"details": {
"proxy env vars": "none"
},
"remediation": null,
"durationMs": 0
},
"network.provider_reachability": {
"id": "network.provider_reachability",
"category": "reachability",
"status": "ok",
"summary": "active provider endpoints are reachable over HTTP",
"details": {
"openai API base URL": "http://host.docker.internal:2455/backend-api/<redacted> reachable (HTTP 405)",
"openai API route probe": "http://host.docker.internal:2455/backend-api/<redacted> route exists (HTTP 401)",
"reachability mode": "API key auth"
},
"remediation": null,
"durationMs": 46
},
"network.websocket_reachability": {
"id": "network.websocket_reachability",
"category": "websocket",
"status": "ok",
"summary": "Responses WebSocket handshake succeeded",
"details": {
"DNS": "1 IPv4, 1 IPv6, first IPv4",
"auth mode": "api_key",
"connect timeout": "15000 ms",
"endpoint": "ws://host.docker.internal:2455/backend-api/<redacted>",
"handshake result": "HTTP 101 Switching Protocols",
"model provider": "openai",
"models etag present": "false",
"provider name": "OpenAI",
"proxy env vars": "none",
"reasoning header": "false",
"server model present": "false",
"supports websockets": "true",
"wire API": "responses"
},
"remediation": null,
"durationMs": 293
},
"runtime.provenance": {
"id": "runtime.provenance",
"category": "runtime",
"status": "ok",
"summary": "running npm on linux-x86_64",
"details": {
"commit": "unknown",
"current executable": "/usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex",
"install method": "npm (package /usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl, bin /usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin, resources /usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-resources, path /usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-path)",
"platform": "linux-x86_64",
"version": "0.138.0"
},
"remediation": null,
"durationMs": 0
},
"runtime.search": {
"id": "runtime.search",
"category": "search",
"status": "ok",
"summary": "search is OK (bundled)",
"details": {
"search command": "/usr/local/share/npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex-path/rg",
"search command readiness": "file exists",
"search provider": "bundled"
},
"remediation": null,
"durationMs": 0
},
"sandbox.helpers": {
"id": "sandbox.helpers",
"category": "sandbox",
"status": "ok",
"summary": "sandbox configuration is readable",
"details": {
"approval policy": "Never",
"codex-linux-sandbox helper": "/home/node/.codex/tmp/arg0/codex-arg0uboZ57/codex-linux-sandbox",
"execve wrapper helper": "/home/node/.codex/tmp/arg0/codex-arg0uboZ57/codex-execve-wrapper",
"filesystem sandbox": "unrestricted",
"network sandbox": "enabled"
},
"remediation": null,
"durationMs": 0
},
"state.paths": {
"id": "state.paths",
"category": "state",
"status": "ok",
"summary": "state paths and databases are inspectable",
"details": {
"CODEX_HOME": "/home/node/.codex (dir)",
"active rollout files": "4680 files, 6362255156 total bytes, 1359456 average bytes",
"archived rollout files": "0 files, 0 total bytes, 0 average bytes",
"goals DB": "/home/node/.codex/goals_1.sqlite (file)",
"goals DB integrity": "ok",
"log DB": "/home/node/.codex/logs_2.sqlite (file)",
"log DB integrity": "ok",
"log dir": "/home/node/.codex/log (dir)",
"memories DB": "/home/node/.codex/memories_1.sqlite (file)",
"memories DB integrity": "ok",
"sqlite home": "/home/node/.codex (dir)",
"state DB": "/home/node/.codex/state_5.sqlite (file)",
"state DB integrity": "ok"
},
"remediation": null,
"durationMs": 2487
},
"state.rollout_db_parity": {
"id": "state.rollout_db_parity",
"category": "threads",
"status": "warning",
"summary": "rollout files and state DB thread inventory differ",
"details": {
"default model provider": "openai",
"rollout DB active files": "4680",
"rollout DB active rows": "4680",
"rollout DB archive mismatches": "0",
"rollout DB archived files": "0",
"rollout DB archived rows": "0",
"rollout DB duplicate DB paths": "0",
"rollout DB duplicate rollout thread ids": "0",
"rollout DB malformed file names": "0",
"rollout DB missing active rows": "150",
"rollout DB missing active sample": [
"/home/node/.codex/sessions/2026/05/10/rollout-2026-05-10T17-02-36-019e13b2-f6ea-74a3-9e21-83c212334986.jsonl",
"/home/node/.codex/sessions/2026/05/10/rollout-2026-05-10T17-03-11-019e13b3-8140-7990-8fc6-e6a830763665.jsonl",
"/home/node/.codex/sessions/2026/05/10/rollout-2026-05-10T07-24-21-019e11a1-917a-7c33-a4ad-dde2c002eb03.jsonl",
"/home/node/.codex/sessions/2026/05/10/rollout-2026-05-10T07-59-13-019e11c1-7b8f-7822-8c5b-44b295c032ea.jsonl",
"/home/node/.codex/sessions/2026/05/10/rollout-2026-05-10T08-00-46-019e11c2-e777-7af1-9df3-2aa26a740269.jsonl"
],
"rollout DB missing archived rows": "0",
"rollout DB model providers": "openai=4666, headroom=14",
"rollout DB rows": "4680",
"rollout DB scan cap reached": "false",
"rollout DB scan errors": "0",
"rollout DB sources": "subagent:thread_spawn=2543, exec=1777, cli=358, vscode=2",
"rollout DB stale row sample": [
"/home/node/.config/codex/sessions/2026/03/30/rollout-2026-03-30T16-29-26-019d406f-dd12-7663-82d5-2028d5606386.jsonl",
"/home/node/.config/codex/sessions/2026/03/30/rollout-2026-03-30T16-37-17-019d4077-0dff-7103-977b-2dba26f5e24f.jsonl",
"/home/node/.config/codex/sessions/2026/03/30/rollout-2026-03-30T16-38-48-019d4078-72ad-7270-8e2a-253266f38b5d.jsonl",
"/home/node/.config/codex/sessions/2026/03/30/rollout-2026-03-30T16-39-16-019d4078-ddea-7000-88c5-48980bbce297.jsonl",
"/home/node/.config/codex/sessions/2026/03/30/rollout-2026-03-30T16-50-40-019d4083-4e5a-71e0-bf36-f6af1701d4f4.jsonl"
],
"rollout DB stale rows": "150"
},
"issues": [
{
"severity": "warning",
"cause": "rollout files are missing from the state DB",
"measured": "150 active, 0 archived",
"expected": "every rollout file has a matching threads row",
"remedy": null,
"fields": []
},
{
"severity": "warning",
"cause": "state DB rows point at missing or unusable rollout files",
"measured": "150 stale rows",
"expected": "every state DB rollout path is a file on disk",
"remedy": null,
"fields": []
}
],
"remediation": null,
"durationMs": 135044
},
"system.environment": {
"id": "system.environment",
"category": "system",
"status": "ok",
"summary": "OS language unavailable",
"details": {
"os": "Debian 13.0.0 [64-bit]",
"os language": "unavailable",
"os type": "Debian",
"os version": "13.0.0"
},
"remediation": null,
"durationMs": 2
},
"terminal.env": {
"id": "terminal.env",
"category": "terminal",
"status": "ok",
"summary": "terminal metadata was detected",
"details": {
"COLORTERM": "truecolor",
"DISPLAY": "present",
"TERM": "xterm-direct",
"WAYLAND_DISPLAY": "present",
"color output": "enabled",
"stderr is terminal": "true",
"stdin is terminal": "true",
"stdout is terminal": "true",
"terminal": "unknown",
"terminal size": "252x67"
},
"remediation": null,
"durationMs": 0
},
"terminal.title": {
"id": "terminal.title",
"category": "title",
"status": "ok",
"summary": "terminal title configured",
"details": {
"terminal title activity": "true",
"terminal title items": "activity, project-name, thread-title, task-progress",
"terminal title project source": "git repo root",
"terminal title project value": "workspace",
"terminal title source": "configured"
},
"remediation": null,
"durationMs": 0
},
"updates.status": {
"id": "updates.status",
"category": "updates",
"status": "ok",
"summary": "update configuration is locally consistent",
"details": {
"cached latest version": "0.138.0",
"check for update on startup": "true",
"last checked at": "2026-06-09T15:19:04.255301229Z",
"latest version": "0.138.0",
"latest version status": "current version is not older",
"npm update target": "/usr/local/share/npm-global/lib/node_modules/@openai/codex",
"update action": "npm install -g @openai/codex",
"version cache": "/home/node/.codex/version.json"
},
"remediation": null,
"durationMs": 380
}
}
}What issue are you seeing?
Any prompt I send returns the same error:
■ {"type":"error","error":{"type":"invalid_request_error","message":"Invalid Value: 'tools'. Function 'functions.followup_task' declares encrypted parameters but is not configured for encrypted tool use by this model.","param":"tools"},"status":400}
What steps can reproduce the bug?
Uploaded thread: 019ead09-6451-75b1-a7e7-3009f4f20b9a
What is the expected behavior?
_No response_
Additional information
_No response_
10 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
I found the following in config.toml which I don't remember adding:
Removing it fixed the problem. Does version 0.138.0 add this to the config, or was it a coincidence that I ended up with this error when I upgraded to it (not accusing, genuinely curious)?
thanks this worked, they must have auto updated this because this bug appeared this morning and i didn't change any settings
remove
seems not work for me
I can confirm a related persistence case here. This is not limited to Desktop. Existing threads that had previously used
multi_agent_v2can continue to fail on resume even after the feature is disabled globally, because the saved rollout history still replays the old v2 team context.In my case:
Invalid Value: 'tools'. Function 'functions.spawn_agent' declares encrypted parameters but is not configured for encrypted tool use by this model.multi_agent/multi_agent_v2.multi_agent_v2continued to fail when resumed.The important detail is that the old rollout JSONL still contained the MultiAgentV2 developer message, including:
and many
turn_contextentries still had"multi_agent_version": "v2".So even after disabling the feature globally, resuming the old thread replayed the saved v2 team context and the request still included the encrypted multi-agent tools.
Local workaround that recovered the thread:
multi_agent_version: "v2"from savedturn_contextentries.--disable multi_agent --disable multi_agent_v2.After that, the old thread could respond again.
I understand
multi_agent_v2is still under development, but it would have been much better if this failed more gracefully: for example by omitting unsupported encrypted multi-agent tools at request time, falling back to a non-multi-agent resume path, or showing a recoverable warning instead of making the whole existing thread unusable.This suggests the fix may need not only a feature-flag/tool-schema guard, but also a migration or resume-time guard for older threads that already persisted the v2 team-mode instructions.
thank you so much, this works for me too.
I am getting the same error, removing multi_agent_v2, doesnt help when I mention "spawn sub agents" I see this error again
Additional confirmed persistence case: resumed threads can keep MultiAgentV2 even after the feature is disabled
I can confirm the old-session persistence variant of this bug with additional local evidence. This appears to be an upstream Codex resume/history issue rather than a LazyCodex or plugin-specific issue.
Environment
0.137.0-alpha.4multi_agent_v2 = falseWhat I observed
turn_context.multi_agent_version = "v2"very early in the conversation history.multi_agent_version = "v2".multi_agent_v2usedmulti_agent_version = "v1"and did not include the encrypted v2-style multi-agent tool schema.Timeline evidence
multi_agent_v2enabled.multi_agent_v2disabled.Source-level evidence
From the current upstream Codex source, the selection path appears to prioritize the conversation history value before falling back to current config:
codex-rs/core/src/session/mod.rs:resolve_multi_agent_version()readsconversation_history.get_multi_agent_version()before usingconfig.multi_agent_version_from_features().codex-rs/core/src/tools/handlers/multi_agents_spec.rs: v1 uses the namespaced multi-agent tool spec, while v2 exposes raw function tools with encrypted message fields.codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs: v2 registers plainspawn_agent.codex-rs/core/src/tools/handlers/multi_agents/spawn.rs: v1 registers the namespaced v1spawn_agent.That explains the symptom: current config can say v2 is disabled, but an old rollout can still force the resumed request onto the v2 tool schema. If the selected model/session is not configured for encrypted tool use, the request fails before the assistant can respond.
Why this is slightly different from only disabling the feature
Disabling
multi_agent_v2fixes new sessions for me. It does not necessarily fix old sessions that already persisted v2 state in their rollout/history. This matches the "new tasks work, old one cannot continue" report in #27548 and the broader config-triggered encrypted-tool failure in #27331.Local recovery path that worked
For the old thread, a safe salvage path was:
function_call/function_call_outputentries and encrypted multi-agent tool metadata.multi_agent_v2is disabled.I avoided editing the original rollout in place for the durable workaround, because the safer recovery path is to preserve the original file and continue from a sanitized transcript.
Suggested fix direction
Codex likely needs a resume-time guard or migration for persisted v2 multi-agent state:
multi_agent_v2is disabled in current config, do not letconversation_history.multi_agent_version = "v2"silently override it on resume.The important failure mode is that a feature flag/config change can make new sessions healthy while old sessions remain permanently unusable because the rollout history re-selects v2.
---
This issue or PR was generated by LazyCodex.
Tag: lazycodex-generated
Issue: Codex Not Working with Multi-Agent Enabled
Steps Taken
config.toml:Rollout auditability matters. Several recovery/workaround comments here involve inspecting or sanitizing old rollout JSONL to get stuck threads working again. #26210 moved MultiAgentV2 subagent task/message text into encrypted payloads, which means the rollout can no longer show what task was delegated to a child agent.
I opened #28058 for the auditability regression. In addition to the schema-validation failure here, losing readable task history makes recovery/debugging much harder when these failures happen. Please react/comment if this impacts your workflow.