Environment:
cptr image: ghcr.io/open-webui/computer:latest (pulled ~2026-07-30)
Codex CLI: 0.146.0 (also reproduced on 0.130.0)
Codex CLI installed via npm install -g @openai/codex, running inside a custom Docker image built on top of ghcr.io/open-webui/computer:latest
Codex configured via ~/.codex/config.toml with a custom OpenAI-compatible provider pointing at a local Ollama instance
Platform: Linux container (Debian bookworm base), Docker Desktop on Windows/WSL2
Description:
Selecting a Codex agent model (either the profile configured under Settings → Agents, or one of the auto-discovered agent:codex/gpt-5.x model IDs) and sending a chat message fails immediately with:
Error: {'code': -32600, 'message': 'Invalid request: unknown variant on-failure, expected one of untrusted, on-request, granular, never'}
This reproduces both when chatting directly in cptr's UI and when routing through Open WebUI via the API Gateway connection (/v1/chat/completions) — same underlying invocation, same failure.
Running codex directly (both codex --version and an interactive codex session) inside the same container works correctly and picks up the same config.toml, confirming Codex CLI itself and its config are fine — the failure is specific to how cptr invokes Codex's app-server.
Steps to reproduce:
Build a ghcr.io/open-webui/computer image with Codex CLI installed (npm install -g @openai/codex@latest) and a valid ~/.codex/config.toml.
Add a Codex agent profile under Settings → Agents (Command: codex, Type: Codex), or let auto-discovery populate agent:codex/* entries.
Start a new chat in the relevant workspace, select the Codex agent/model.
Send any message.
Expected: Codex responds normally, as it does when invoked directly via the terminal.
Actual: Immediate JSON-RPC -32600 Invalid request error citing on-failure as an unrecognized approval_policy variant.
Suspected cause: cptr's Codex app-server invocation appears to hardcode approval_policy = "on-failure" when starting a session. This value was valid in earlier Codex CLI releases but has since been replaced by granular (per current Codex CLI's own accepted enum: untrusted | on-request | granular | never). Downgrading Codex CLI to a version old enough to accept on-failure (tested down to 0.29.0) causes a different failure — the agent no longer registers as an available model at all, presumably because that version predates app-server support. This suggests there may be no Codex CLI version compatible with cptr's current integration as-is.
Suggested fix: Update cptr's Codex integration to send granular (or make the approval policy value configurable/detected based on the installed Codex CLI's supported variants) instead of the hardcoded on-failure.
Environment:
cptr image: ghcr.io/open-webui/computer:latest (pulled ~2026-07-30)
Codex CLI: 0.146.0 (also reproduced on 0.130.0)
Codex CLI installed via npm install -g @openai/codex, running inside a custom Docker image built on top of ghcr.io/open-webui/computer:latest
Codex configured via ~/.codex/config.toml with a custom OpenAI-compatible provider pointing at a local Ollama instance
Platform: Linux container (Debian bookworm base), Docker Desktop on Windows/WSL2
Description:
Selecting a Codex agent model (either the profile configured under Settings → Agents, or one of the auto-discovered agent:codex/gpt-5.x model IDs) and sending a chat message fails immediately with:
Error: {'code': -32600, 'message': 'Invalid request: unknown variant
on-failure, expected one ofuntrusted,on-request,granular,never'}This reproduces both when chatting directly in cptr's UI and when routing through Open WebUI via the API Gateway connection (/v1/chat/completions) — same underlying invocation, same failure.
Running codex directly (both codex --version and an interactive codex session) inside the same container works correctly and picks up the same config.toml, confirming Codex CLI itself and its config are fine — the failure is specific to how cptr invokes Codex's app-server.
Steps to reproduce:
Build a ghcr.io/open-webui/computer image with Codex CLI installed (npm install -g @openai/codex@latest) and a valid ~/.codex/config.toml.
Add a Codex agent profile under Settings → Agents (Command: codex, Type: Codex), or let auto-discovery populate agent:codex/* entries.
Start a new chat in the relevant workspace, select the Codex agent/model.
Send any message.
Expected: Codex responds normally, as it does when invoked directly via the terminal.
Actual: Immediate JSON-RPC -32600 Invalid request error citing on-failure as an unrecognized approval_policy variant.
Suspected cause: cptr's Codex app-server invocation appears to hardcode approval_policy = "on-failure" when starting a session. This value was valid in earlier Codex CLI releases but has since been replaced by granular (per current Codex CLI's own accepted enum: untrusted | on-request | granular | never). Downgrading Codex CLI to a version old enough to accept on-failure (tested down to 0.29.0) causes a different failure — the agent no longer registers as an available model at all, presumably because that version predates app-server support. This suggests there may be no Codex CLI version compatible with cptr's current integration as-is.
Suggested fix: Update cptr's Codex integration to send granular (or make the approval policy value configurable/detected based on the installed Codex CLI's supported variants) instead of the hardcoded on-failure.