Plaintext Agent Handoffs Fix Multi-Model Swarms

Ethan Park

Remember last week when we were talking about how MultiAgent V2 default payload encryption basically broke local SQLite logs? Well, it, it turns out the problem was actually way, way worse if you were trying to run mixed model agent swarms.

Maya

Wait, you mean like when an OpenAI parent agent tries to hand off a subtask to a non OpenAI model?

Ethan Park

Exactly. Because the subagent couldn't decrypt the payload, it just received a completely empty task payload. It was like sending a worker a sealed envelope that only one specific person had the key to open, and then getting mad when they just sat there doing nothing. Quick shoutout to Jellypod, by the way, for supporting this daily installment and helping us keep these technical deep dives coming.

Maya

A sealed envelope with literally zero instructions inside, yeah, that, that would definitely halt a swarm real quick. But they fixed this in the latest release, right?

Ethan Park

They did. PR 35845, which was just included in Codex 0 point 147 point 0 alpha 1, added support for processing plaintext collaboration tool messages. So, under the hood, it introduces this new source type called ToolCallSource DirectPlaintextMessage.

Maya

DirectPlaintextMessage. Okay, so how does that actually alter the payload routing?

Ethan Park

Instead of taking those critical instructions like spawn agent, send message, or followup task and wrapping them up inside encrypted content, the system now evaluates encrypted function args and routes them directly through the structured input text field. So the target model gets plain, legible instructions regardless of whether it shares encryption keys with the parent model.

Maya

Ah, okay! So it bypasses that whole decryption barrier entirely while keeping the structured tool call intact. That is so much cleaner for multi provider setups. And if someone wants to turn this on in their project right now, how do they configure it?

Ethan Park

It is super straightforward. In your dot codex slash config dot toml file, under the section bracketed as features dot multi agent v2, you just add message delivery equals quote plaintext quote.

Maya

I actually tested this exact flag yesterday on a local benchmark run! And I have to say, the developer experience improvement is massive. Beyond just unblocking third party models, it completely fixes those unreadable local SQLite database tables we complained about. You open up your local logs or your terminal thread view, and you can actually read the exact plaintext prompts and tool outputs moving between subagents in real time, instead of just staring at blobs of unreadable hex bytes.

Ethan Park

Man, not having to manually run decryption scripts just to debug a failed agent handoff sounds like a dream. But, um, speaking of multi provider swarms, there are still a few sharp edges around API validation that people are running into, right?

Maya

Oh, absolutely. Even with plaintext delivery enabled, there is this tricky cross provider validation trap. So picture this: you have an OpenAI model acting as the main orchestrator, and it tries to spawn a third party child model, say DeepSeek or a custom model gateway. Well, if that upstream API provider has strict rules that reject non standard function schemas under the reserved collaboration namespace, the whole request just stalls out with a schema validation failure.

Ethan Park

Right, because OpenAI expects specific tool schemas for agent orchestration, but a custom gateway or third party provider might look at those collaboration schemas and go, nope, unknown parameter structure, request denied.

Maya

Exactly. So while plaintext solves the payload readability and parsing problem, schema translation across different provider APIs is still something you have to carefully shim if you are building custom gateways.

Ethan Park

That makes total sense. And speaking of API level rejections, there was another really frustrating bug in Codex 0 point 146 point 0 that caught a ton of people off guard. It was documented in Issue 36735.

Maya

Oh, was that the one breaking gpt 4o mini calls?

Ethan Park

Yes! So basically, Codex CLI 0 point 146 point 0 sends reasoning dot effort colon quote none quote when using the non reasoning model gpt 4o mini. And because gpt 4o mini is a standard non reasoning model that does not accept reasoning parameters at all, the upstream API immediately threw HTTP 400 errors every single time you tried to run a request.

Maya

Wow. Sending a reasoning parameter of none to a model that does not support reasoning effort parameters in the first place, causing a hard HTTP 400 crash. That is such a classic CLI flag leak.

Ethan Park

It really was. Thankfully, they patched that bug fast, but it hit a lot of developer pipelines that relied on lightweight models for fast, cheap tasks.

Maya

Glad that is sorted. What else landed in the recent patches?

Ethan Park

So in the 0 point 146 point 1 release, they backported PR 37057, which focuses heavily on safety and terminal polish. Specifically, the team decided to apply safer automatic review defaults for cyber capable models, while also making sure to explain permission changes in the terminal interface whenever elevated tool permissions are requested.

Maya

That permission feedback in the terminal interface is huge. Whenever an agent requests elevated execution rights or accesses cyber security capabilities, seeing a clear explanation of what changed in your terminal permission state before executing the tool keeps you from accidentally approving destructive operations in the background.

Ethan Park

Exactly. Between plaintext agent communication unblocking multi provider swarms and cleaner, safer terminal permissions, the framework is getting so much more mature for real world agent deployment.

Maya

Totally. Alright, that is the latest update. Good chatting with you, Ethan!

Ethan Park

Yeah, talk soon!