Auto-review/Guardian sends unsupported additional_tools input item to OpenAI-compatible providers when Responses-Lite is enabled

What version of Codex CLI is running?

0.148.0

What subscription do you have?

Plus

Which model were you using?

codex-auto-review (Guardian subagent); primary model via Ollama/OpenAI-compatible provider

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What terminal emulator and version are you using (if applicable)?

PowerShell 7.6.3

Codex doctor report

{
  "schemaVersion": 1,
  "generatedAt": "1787167907s since unix epoch",
  "overallStatus": "warning",
  "codexVersion": "0.148.0",
  "checks": {
    "app_server.status": {
      "id": "app_server.status",
      "category": "app-server",
      "status": "ok",
      "summary": "background server is not running",
      "details": {
        "control socket": "C:\\Users\\Wilfried\\.codex\\app-server-control\\app-server-control.sock",
        "daemon state dir": "C:\\Users\\Wilfried\\.codex\\app-server-daemon",
        "mode": "ephemeral",
        "pid file": "C:\\Users\\Wilfried\\.codex\\app-server-daemon\\app-server.pid (missing)",
        "settings": "C:\\Users\\Wilfried\\.codex\\app-server-daemon\\settings.json (missing)",
        "status": "not running",
        "update-loop pid file": "C:\\Users\\Wilfried\\.codex\\app-server-daemon\\app-server-updater.pid (missing)"
      },
      "remediation": null,
      "durationMs": 0
    },
    "auth.credentials": {
      "id": "auth.credentials",
      "category": "auth",
      "status": "ok",
      "summary": "auth is configured",
      "details": {
        "auth file": "C:\\Users\\Wilfried\\.codex\\auth.json",
        "auth storage mode": "File",
        "stored API key": "false",
        "stored ChatGPT tokens": "true",
        "stored agent identity": "false",
        "stored auth mode": "chatgpt"
      },
      "remediation": null,
      "durationMs": 0
    },
    "config.load": {
      "id": "config.load",
      "category": "config",
      "status": "ok",
      "summary": "config loaded",
      "details": {
        "CODEX_HOME": "C:\\Users\\Wilfried\\.codex",
        "config.toml": "C:\\Users\\Wilfried\\.codex\\config.toml",
        "config.toml parse": "ok",
        "cwd": "C:\\Users\\Wilfried\\Documents\\Python Projects\\CodexTest\\openclaw",
        "enabled feature flags": "<redacted>",
        "feature flag overrides": "memories=true",
        "feature flags enabled": "42",
        "log dir": "C:\\Users\\Wilfried\\.codex\\log",
        "mcp servers": "0",
        "model": "gpt-5.6-sol",
        "model provider": "openai",
        "sqlite home": "C:\\Users\\Wilfried\\.codex"
      },
      "remediation": null,
      "durationMs": 0
    },
    "git.environment": {
      "id": "git.environment",
      "category": "git",
      "status": "ok",
      "summary": "git version 2.40.0.windows.1",
      "details": {
        ".git entry": "directory",
        "PATH git #1": "C:\\Program Files\\Git\\cmd\\git.exe",
        "PATH git entries": "1",
        "git branch": "master",
        "git build options": "git version 2.40.0.windows.1; cpu: x86_64; built from commit: 1d90ca2906dd4b7ddaf0669a13c173ec579d794a; sizeof-long: 4; sizeof-size_t: 8; shell-path: /bin/sh; feature: fsmonitor--daemon",
        "git exec path": "C:/Program Files/Git/mingw64/libexec/git-core",
        "git version": "git version 2.40.0.windows.1",
        "repo detected": "true",
        "repo root": "C:\\Users\\Wilfried\\Documents\\Python Projects\\CodexTest\\openclaw",
        "selected git": "C:\\Program Files\\Git\\cmd\\git.exe"
      },
      "remediation": null,
      "durationMs": 79
    },
    "git.worktree.dev_drive": {
      "id": "git.worktree.dev_drive",
      "category": "git",
      "status": "warning",
      "summary": "this worktree is not on a Windows Dev Drive; moving it to a trusted Dev Drive can significantly improve repository and filesystem performance",
      "details": {},
      "remediation": "create a trusted Windows Dev Drive for source repositories: https://learn.microsoft.com/en-us/<redacted>",
      "durationMs": 0
    },
    "installation": {
      "id": "installation",
      "category": "install",
      "status": "ok",
      "summary": "installation looks consistent",
      "details": {
        "PATH codex #1": "C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\codex",
        "PATH codex #2": "C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\codex.cmd",
        "PATH codex entries": "2",
        "current executable": "C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin\\codex.exe",
        "install context": "npm (package C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc, bin C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin, resources C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path)",
        "managed by bun": "false",
        "managed by npm": "true",
        "managed by pnpm": "false",
        "managed package root": "C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex",
        "npm update target": "C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex"
      },
      "remediation": null,
      "durationMs": 344
    },
    "mcp.config": {
      "id": "mcp.config",
      "category": "mcp",
      "status": "ok",
      "summary": "no MCP servers configured",
      "details": {},
      "remediation": null,
      "durationMs": 0
    },
    "network.env": {
      "id": "network.env",
      "category": "network",
      "status": "ok",
      "summary": "network-related environment looks readable",
      "details": {
        "SSL_CERT_FILE": "readable file C:\\Users\\Wilfried\\anaconda3\\Library\\ssl\\cacert.pem",
        "proxy env vars": "none"
      },
      "remediation": null,
      "durationMs": 0
    },
    "network.provider_reachability": {
      "id": "network.provider_reachability",
      "category": "reachability",
      "status": "ok",
      "summary": "active provider endpoints are reachable over HTTP",
      "details": {
        "ChatGPT base URL": "https://chatgpt.com/backend-api/ reachable (HTTP 404)",
        "reachability mode": "ChatGPT auth"
      },
      "remediation": null,
      "durationMs": 177
    },
    "network.websocket_reachability": {
      "id": "network.websocket_reachability",
      "category": "websocket",
      "status": "ok",
      "summary": "Responses WebSocket handshake succeeded",
      "details": {
        "DNS": "2 IPv4, 2 IPv6, first IPv6",
        "auth mode": "chatgpt",
        "connect timeout": "15000 ms",
        "endpoint": "wss://chatgpt.com/backend-api/<redacted>",
        "handshake result": "HTTP 101 Switching Protocols",
        "model provider": "openai",
        "provider name": "OpenAI",
        "proxy env vars": "none",
        "reasoning header": "false",
        "server model present": "false",
        "supports websockets": "true",
        "wire API": "responses"
      },
      "remediation": null,
      "durationMs": 1041
    },
    "runtime.provenance": {
      "id": "runtime.provenance",
      "category": "runtime",
      "status": "ok",
      "summary": "running npm on windows-x86_64",
      "details": {
        "commit": "unknown",
        "current executable": "C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin\\codex.exe",
        "install method": "npm (package C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc, bin C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\bin, resources C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-resources, path C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path)",
        "platform": "windows-x86_64",
        "version": "0.148.0"
      },
      "remediation": null,
      "durationMs": 0
    },
    "runtime.search": {
      "id": "runtime.search",
      "category": "search",
      "status": "ok",
      "summary": "search is OK (bundled)",
      "details": {
        "search command": "C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex\\node_modules\\@openai\\codex-win32-x64\\vendor\\x86_64-pc-windows-msvc\\codex-path\\rg.exe",
        "search command readiness": "file exists",
        "search provider": "bundled"
      },
      "remediation": null,
      "durationMs": 0
    },
    "sandbox.helpers": {
      "id": "sandbox.helpers",
      "category": "sandbox",
      "status": "ok",
      "summary": "sandbox configuration is readable",
      "details": {
        "approval policy": "OnRequest",
        "codex-linux-sandbox helper": "none",
        "execve wrapper helper": "none",
        "filesystem sandbox": "restricted",
        "network sandbox": "restricted"
      },
      "remediation": null,
      "durationMs": 0
    },
    "state.paths": {
      "id": "state.paths",
      "category": "state",
      "status": "ok",
      "summary": "state paths and databases are inspectable",
      "details": {
        "CODEX_HOME": "C:\\Users\\Wilfried\\.codex (dir)",
        "active rollout files": "262 files, 516949341 total bytes, 1973089 average bytes",
        "archived rollout files": "0 files, 0 total bytes, 0 average bytes",
        "goals DB": "C:\\Users\\Wilfried\\.codex\\goals_1.sqlite (file)",
        "goals DB integrity": "ok",
        "log DB": "C:\\Users\\Wilfried\\.codex\\logs_2.sqlite (file)",
        "log DB integrity": "ok",
        "log dir": "C:\\Users\\Wilfried\\.codex\\log (dir)",
        "memories DB": "C:\\Users\\Wilfried\\.codex\\memories_1.sqlite (file)",
        "memories DB integrity": "ok",
        "queue DB": "C:\\Users\\Wilfried\\.codex\\queue_1.sqlite (file)",
        "queue DB integrity": "ok",
        "sqlite home": "C:\\Users\\Wilfried\\.codex (dir)",
        "state DB": "C:\\Users\\Wilfried\\.codex\\state_5.sqlite (file)",
        "state DB integrity": "ok",
        "thread history DB": "C:\\Users\\Wilfried\\.codex\\thread_history_1.sqlite (file)",
        "thread history DB integrity": "ok"
      },
      "remediation": null,
      "durationMs": 855
    },
    "state.rollout_db_parity": {
      "id": "state.rollout_db_parity",
      "category": "threads",
      "status": "ok",
      "summary": "rollout files and state DB thread inventory agree",
      "details": {
        "default model provider": "openai",
        "rollout DB active files": "262",
        "rollout DB active rows": "262",
        "rollout DB archive mismatches": "0",
        "rollout DB archived files": "0",
        "rollout DB archived rows": "0",
        "rollout DB duplicate DB paths": "0",
        "rollout DB duplicate rollout thread ids": "0",
        "rollout DB malformed file names": "0",
        "rollout DB missing active rows": "0",
        "rollout DB missing archived rows": "0",
        "rollout DB model providers": "openai=195, ollama_cloud=67",
        "rollout DB rows": "262",
        "rollout DB scan cap reached": "false",
        "rollout DB scan errors": "0",
        "rollout DB sources": "cli=189, subagent:other=43, exec=30",
        "rollout DB stale rows": "0"
      },
      "remediation": null,
      "durationMs": 3979
    },
    "system.disk": {
      "id": "system.disk",
      "category": "disk",
      "status": "ok",
      "summary": "sufficient free disk space (1093.1 GiB)",
      "details": {
        "CODEX_HOME available": "1093.1 GiB",
        "failure threshold": "1.0 GiB",
        "warning threshold": "5.0 GiB",
        "worktree available": "1093.1 GiB"
      },
      "remediation": null,
      "durationMs": 0
    },
    "system.environment": {
      "id": "system.environment",
      "category": "system",
      "status": "ok",
      "summary": "OS language de-DE",
      "details": {
        "EDITOR": "not set",
        "VISUAL": "not set",
        "os": "Windows 10.0.26200 (Windows 11 Professional) [64-bit]",
        "os language": "de-DE",
        "os type": "Windows",
        "os version": "10.0.26200"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.env": {
      "id": "terminal.env",
      "category": "terminal",
      "status": "ok",
      "summary": "terminal metadata was detected",
      "details": {
        "WT_SESSION": "present",
        "color output": "enabled",
        "console input code page": "850",
        "console output code page": "850",
        "stderr console mode": "0x00000007 (VT processing: true)",
        "stderr is terminal": "true",
        "stdin is terminal": "true",
        "stdout console mode": "0x00000007 (VT processing: true)",
        "stdout is terminal": "true",
        "terminal": "Windows Terminal",
        "terminal size": "120x30"
      },
      "remediation": null,
      "durationMs": 0
    },
    "terminal.title": {
      "id": "terminal.title",
      "category": "title",
      "status": "ok",
      "summary": "terminal title default",
      "details": {
        "terminal title activity": "true",
        "terminal title items": "activity, project-name",
        "terminal title project source": "git repo root",
        "terminal title project value": "openclaw",
        "terminal title source": "default"
      },
      "remediation": null,
      "durationMs": 0
    },
    "updates.status": {
      "id": "updates.status",
      "category": "updates",
      "status": "ok",
      "summary": "update configuration is locally consistent",
      "details": {
        "cached latest version": "0.148.0",
        "check for update on startup": "true",
        "dismissed version": "0.148.0",
        "last checked at": "2026-08-19T10:34:54.277838100Z",
        "latest version": "0.148.0",
        "latest version status": "current version is not older",
        "npm update target": "C:\\Users\\Wilfried\\AppData\\Roaming\\npm\\node_modules\\@openai\\codex",
        "update action": "npm install -g @openai/codex",
        "version cache": "C:\\Users\\Wilfried\\.codex\\version.json"
      },
      "remediation": null,
      "durationMs": 746
    }
  }
}

What issue are you seeing?

Codex auto-review / Guardian requests fail against an OpenAI-compatible Responses API endpoint when Codex enables the Responses-Lite path.

In the failing requests Codex prepends an input item with:

type: "additional_tools"

The upstream /v1/responses endpoint rejects this with HTTP 400:

input[0]: unknown input item type: "additional_tools"

The failure is strongly correlated with the request header:

x-openai-internal-codex-responses-lite: true

This affects the Guardian subagent (codex-auto-review). In particular, commands requiring an escalated permission review can become unusable because the Guardian request itself fails before it can approve or reject the command.

I observed this with both Codex CLI 0.146.0, 0.147.0 and 0.148.0, so it does not appear to be specific to one Codex version.

What steps can reproduce the bug?

1. Configure Codex CLI to use an OpenAI-compatible provider implementing /v1/responses.

In my case this is an Ollama-compatible endpoint behind a transparent trace proxy.

1. Run Codex in a situation where the Guardian / auto-review subagent is invoked, e.g. a command requiring an escalated permission review.

1. When Codex selects the Responses-Lite path, inspect the outgoing Guardian request.

1. The request has:

x-openai-internal-codex-responses-lite: true

and its input array begins with an item of type:

"additional_tools"

1. The provider returns HTTP 400:

{"error":{"message":"input[0]: unknown input item type: \"additional_tools\"",
"type":"invalid_request_error",
"param":null,
"code":null}}

A/B verification:

With Codex CLI 0.148.0 I intercepted the request in a transparent proxy and removed ONLY input items whose type is additional_tools before forwarding the request.

Before workaround:

• v0.148.0
• Responses-Lite = true
• additional_tools present
• HTTP 400

After stripping exactly one additional_tools input item:

• same v0.148.0
• Responses-Lite = true
• same Guardian / auto-review path
• HTTP 200
• normal review response returned

This makes the additional_tools input item the isolated trigger in my test.

What is the expected behavior?

Codex should not send Codex-internal input item types such as additional_tools to a generic OpenAI-compatible /v1/responses provider unless that capability is known to be supported.

The Guardian / auto-review request should either:

• use standard Responses API request fields supported by the configured provider, or
• omit additional_tools when using a non-OpenAI/custom provider.

The Guardian should then be able to complete the review normally instead of failing with HTTP 400.

Additional information

This was diagnosed from 149 traced codex-auto-review turns.

Observed results:

Codex 0.146.0:

• 146 traced turns
• 117 HTTP 200
• 17 HTTP 400 caused by additional_tools
• all 17 relevant HTTP 400 responses had Responses-Lite enabled

Codex 0.148.0:

• before the workaround, every observed Guardian turn using Responses-Lite failed with the same HTTP 400
• after stripping additional_tools in the proxy, the same path returned HTTP 200

Example v0.148.0 A/B test:

Before proxy workaround:

• turn 003878: HTTP 400, Responses-Lite=true, additional_tools present
• turn 003901: HTTP 400, Responses-Lite=true, additional_tools present

After proxy workaround:

• turn 003927: HTTP 200, Responses-Lite=true
• original request still contained one additional_tools item
• proxy removed exactly that item before forwarding
• upstream returned a normal ~12 KB Guardian review response

The proxy preserves the original request in the trace, so the successful request can be compared directly with the unmodified request.

I also observed successful Guardian requests where Responses-Lite was false and no additional_tools item was present.

There were unrelated HTTP 503 responses in the trace; those appear to be a separate provider availability issue and are not included in this bug.