MultiAgentV2 encrypted spawn_agent schema returns 400: model not configured for encrypted tool use

[lovingfish]

What happened?

After updating to the current alpha CLI, enabling features.multi_agent_v2 makes every Codex turn fail before the model handles the prompt.

This happens even when the prompt does not ask to use a subagent, because the model-visible functions.spawn_agent tool schema is rejected by the API request validator.

Minimal repro

Config:

[features]
multi_agent_v2 = true

Command:

codex exec --json --ephemeral --skip-git-repo-check -C /tmp 'Reply exactly: DONE'

Actual behavior

The turn fails with a 400 response:

{
  "type": "error",
  "error": {
    "type": "invalid_request_error",
    "message": "Invalid Value: 'tools'. Function 'functions.spawn_agent' declares encrypted parameters but is not configured for encrypted tool use by this model.",
    "param": "tools"
  },
  "status": 400
}

I also reproduced the same failure with gpt-5.4 and gpt-5.4-mini, so this does not appear to be limited to one selected model slug.

Expected behavior

Either:

• the selected model/backend accepts the MultiAgentV2 encrypted tool schema, or
• Codex avoids exposing encrypted MultiAgentV2 tools unless the active model/backend is configured for encrypted tool use.

At minimum, a user config that enables multi_agent_v2 should not make unrelated turns fail at request validation time.

Workaround

Disabling MultiAgentV2 avoids the 400:

codex exec --json --ephemeral --skip-git-repo-check -C /tmp --disable multi_agent_v2 'Reply exactly: DONE'

With multi_agent_v2 disabled, the legacy/stable subagent flow still works for spawn/wait in my local repro.

Suspected regression

This looks related to #26210 (Encrypt multi-agent v2 message payloads), which marks MultiAgentV2 spawn_agent, send_message, and followup_task message parameters as encrypted.

Relevant local source path after pulling latest:

• codex-rs/core/src/tools/handlers/multi_agents_spec.rs marks spawn_agent.message with with_encrypted()
• codex-rs/tools/src/json_schema.rs serializes the encrypted schema marker
• codex-rs/core/src/tools/spec_plan.rs includes direct model-visible tools in the request whenever multi_agent_v2 is enabled

Environment

• Codex CLI: 0.138.0-alpha.6
• OS: WSL Ubuntu 24.04 on Windows 11
• Auth/provider: normal Codex CLI login
• Repro confirmed after git pull --ff-only in a local openai/codex checkout

[WindLucker]

Can confirm this behavior. It seems this issue was introduced with the release of version 0.137.0. Rolling back to 0.136.0 resolves the error and works fine as a temporary fix.

[etraut-openai]

The multiagent v2 feature is still under development. We don't recommend its use, and we are not taking bug reports on this feature at this time.

[lovingfish]

The multiagent v2 feature is still under development. We don't recommend its use, and we are not taking bug reports on this feature at this time.

ok, roll back to multiagent v1 and works normally

[xsyetopz]

Same thing happens on multi_agent stable on release 0.138.0.

@etraut-openai could y'guys STOP breaking f**king production? Holy Heavens, ever heard of QA?

[cowwoc]

@etraut-openai I filed #27205 for the issue that @xsyetopz mentioned. It makes 0.138.0 unusable (literally can't send any prompt) for me.

[agirardeau]

Same issue for me on 0.139.0, rolled back to 0.137.0.