Codex image summaries fail because -i consumes exec

[alfozan]

Summary

Local image summaries fail when the Codex CLI backend is selected because summarize puts Codex image args before the exec subcommand:

codex -i <image.jpg> exec --output-last-message ...

Codex's -i/--image <FILE>... option accepts multiple files, so exec can be consumed as another image argument. The remaining --output-last-message flag is then parsed at the wrong command level and Codex exits before the summary starts.

Reproduction

This came up from a repo workspace with a local WhatsApp media image. The exact file is not important, any local JPEG that uses the Codex backend should exercise the same argv shape:

summarize /path/to/WhatsApp-Assistant/profiles/global-equities-testing/media/3AFF789EBAE19B8737AB/0-example.jpg --length short --plain

Observed failure:

Command failed: codex -i /path/to/image.jpg exec --output-last-message /tmp/.../last-message.txt --skip-git-repo-check --json -m gpt-5.5 -c text.verbosity="medium"
error: unexpected argument '--output-last-message' found

Running the same Codex invocation with exec before -i works:

codex exec -i /path/to/image.jpg --output-last-message /tmp/last-message.txt --skip-git-repo-check --json -m gpt-5.5 'Summarize this image briefly.'

Expected behavior

The Codex backend should invoke image summaries as:

codex exec -i <image.jpg> --output-last-message ...

Likely cause

buildAssetCliContext() correctly adds Codex image attachment args as:

codex: ["-i", filePath]

But the Codex provider path in src/llm/cli.ts appends those extra args before exec. This is adjacent to the Codex argument construction touched by #215, but #215 fixed isolation/context loading and did not change the relative order of codexExtraArgs and exec.

Proposed fix

Move the Codex subcommand before provider-specific extra args:

args.push("exec");
args.push(...codexExtraArgs);

and add a regression test asserting that exec appears before -i for image summaries.

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed June 8, 2026, 1:31 AM ET / 05:31 UTC.

Summary
Keep open: current main and v0.16.3 still build Codex image-summary args with -i before exec, and the linked unmerged fix PR should own the repair until it lands.

Reproducibility: yes. source inspection gives a high-confidence path because image assets add -i <path> and the current Codex path places those args before exec. I did not run a live Codex CLI reproduction in this read-only review.

Next step
An open linked PR already owns the narrow fix, so ClawSweeper should not queue a competing repair.

Review details

Best possible solution:

Review and land or close #243; keep this issue open until the fix is merged and released.

Do we have a high-confidence way to reproduce the issue?

Yes: source inspection gives a high-confidence path because image assets add -i <path> and the current Codex path places those args before exec. I did not run a live Codex CLI reproduction in this read-only review.

Is this the best way to solve the issue?

Yes: moving exec before Codex-specific extra args and adding a targeted regression test is the narrow maintainable fix. The linked PR already follows that direction, so a competing repair lane is unnecessary.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 769d01f0898f.

Label changes

Label changes:

• add P2: This is a concrete Codex backend bug affecting image summaries with limited provider-specific blast radius.
• add impact:auth-provider: The issue is in provider-specific Codex CLI invocation and breaks that backend for local image summaries.
• add issue-rating: 🦞 diamond lobster: Current issue advisory state selects this label.
• add clawsweeper:source-repro: Current issue advisory state selects this label.

Label justifications:

• P2: This is a concrete Codex backend bug affecting image summaries with limited provider-specific blast radius.
• impact:auth-provider: The issue is in provider-specific Codex CLI invocation and breaks that backend for local image summaries.

Evidence reviewed

What I checked:

• Current Codex argv order is still affected: The Codex provider path appends codexExtraArgs before pushing the exec subcommand, so image-specific -i args are emitted at the Codex top level. (src/llm/cli.ts:307, 769d01f0898f)
• Image summaries supply Codex -i through provider extra args: Asset CLI context maps image attachments to Codex extra args as ['-i', filePath], which then flow into the affected Codex argv builder. (src/run/flows/asset/summary-attempts.ts:134, 769d01f0898f)
• Latest release still has the same order: The v0.16.3 release source also pushes codexExtraArgs before exec, so the issue is not fixed in the latest release. (src/llm/cli.ts:296, fcf8c8e5e98d)
• Open linked fix PR owns the implementation path: The provided GitHub context shows Fix Codex image arg order #243 is open, references this issue with closing syntax, and proposes the exact argv-order fix plus regression coverage.
• Relevant history points to the Codex CLI area: Blame and history show Peter Steinberger authored the current Codex argument block in the v0.16.3 release and previously changed the same area for Codex isolation. (src/llm/cli.ts:288, fcf8c8e5e98d)

Likely related people:

• steipete: Authored the current Codex CLI argument block, the Codex isolation fix, and the extracted asset summary attempt builder that supplies image args. (role: feature owner / recent area contributor; confidence: high; commits: fcf8c8e5e98d, 352a9f195099, b2e473a09c12; files: src/llm/cli.ts, src/run/flows/asset/summary-attempts.ts, tests/llm.cli.test.ts)
• Mykhailo: Recently touched src/llm/cli.ts while adding another CLI provider, so they may have context on the provider dispatch shape. (role: recent adjacent contributor; confidence: low; commits: 821e76613ded; files: src/llm/cli.ts)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Fixed on main by PR #243, merge commit 895583c3d14bf796a7e71af013750ac0811aaf7c.

Proof:

• Current main repro before the fix failed with codex -i /tmp/<generated-image>.png exec --output-last-message ... and error: unexpected argument '--output-last-message' found.
• Fixed branch live run passed: pnpm -s summarize /tmp/<generated-image>.png --model cli/codex/kindle-alpha --plain --length short --timeout 2m returned a plain Codex-backed image summary.
• Focused tests passed: pnpm test tests/llm.cli.regressions.test.ts tests/llm.cli.test.ts.
• Full gate passed: pnpm -s check.
• Autoreview passed clean: local mode and branch mode against origin/main.
• GitGuardian Security Checks passed.

Thanks @alfozan.