HKUDS/Vibe-Trading · critical · CodexAuthenticationError

The Vibe-Trading Codex OAuth session was invalidated

Error message

The Vibe-Trading Codex OAuth session was invalidated

What it means

During token retrieval, the refresh attempt failed with a _CodexRefreshError marked permanent (e.g. refresh token invalidated/reused). The library clears the stored token and raises CodexAuthenticationError because the session cannot be recovered automatically.

Source

Thrown at agent/src/providers/openai_codex.py:370

    with _codex_refresh_lock(storage):
        latest = storage.load()
        if not (latest and latest.access and latest.refresh and latest.account_id):
            raise _missing_codex_login_error()
        token = latest
        now_ms = int(time.time() * 1000)

        if rejected_access and token.access != rejected_access and _token_expiry_ms(token) > now_ms:
            return token
        if not force_refresh and _token_expiry_ms(token) - now_ms > _CODEX_REFRESH_MARGIN_SECONDS * 1000:
            return token

        try:
            refreshed = _refresh_codex_token(token, storage)
        except _CodexRefreshError as exc:
            if exc.permanent:
                _clear_codex_token(storage)
                raise CodexAuthenticationError("The Vibe-Trading Codex OAuth session was invalidated") from exc
            if not force_refresh and _token_expiry_ms(token) > now_ms:
                return token
            raise CodexStreamError(
                exc.status_code or 503,
                f"Codex OAuth recovery temporarily failed: {exc}",
            ) from exc
        if refreshed.access == token.access:
            if not force_refresh and _token_expiry_ms(token) > now_ms:
                return token
            _clear_codex_token(storage)
            raise CodexAuthenticationError("The Codex backend rejected the access token and refresh did not replace it")
        return refreshed


def validate_codex_base_url(url: str) -> str:
    """Validate the only supported ChatGPT Codex OAuth endpoint.

    ChatGPT OAuth tokens must not be sent to arbitrary OpenAI-compatible base

View on GitHub (pinned to 80ffdda44c)

Solutions

1. Re-authenticate interactively: run the Codex provider login command to write a fresh token to Vibe-owned storage
2. Ensure only one process owns the OAuth session (don't copy auth files between machines)
3. After re-login, retry the request; no code change needed

Example fix

# before
CodexAuthenticationError: The Vibe-Trading Codex OAuth session was invalidated

# after
# terminal 1
vibe-trading provider login openai-codex
# then retry the original request

from src.providers.openai_codex import get_openai_codex_login_status
if not get_openai_codex_login_status().logged_in:
    raise SystemExit('Run Codex login first')

try:
    token = _get_codex_token(storage)
except CodexAuthenticationError:
    logging.warning('session invalidated; launching interactive login')
    login_openai_codex()
    token = _get_codex_token(storage)

When it happens

Trigger: The stored Codex refresh token was revoked, reused by another process, or invalidated server-side (the token_invalidated/refresh_token_reused failure), then any request needing auth calls _get_codex_token.

Common situations: Logging in from two machines/processes sharing one token file (issue #975 style refresh-token reuse); revoking sessions in the ChatGPT UI; long-stale tokens after password/security changes.

Related errors

• The Codex backend rejected the access token and refresh did
• oauth-cli-kit is not installed. Run: pip install oauth-cli-k
• No supported file-lock backend for Codex OAuth refresh
• OpenAI Codex OAuth requires oauth-cli-kit. Install dependenc
• OpenAI Codex OAuth only supports https://chatgpt.com/backend

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/36b5d9021d6bae26. Report an issue: GitHub.