Yeachan-Heo/oh-my-codex · critical · Error

Refusing cancellation because detached run authority is inva

Error message

Refusing cancellation because detached run authority is invalid: ${record.run_dir}.

What it means

Wrapper around any per-record authority validation failure (213–216 or a read error) during cancellation discovery; it names the offending run_dir and chains the root cause, refusing cancellation for safety.

Source

Thrown at src/cli/index.ts:8161

    try {
      const canonicalRunDir = realpathSync(resolve(record.run_dir));
      if (!isCanonicalPathWithin(canonicalRunsRoot, canonicalRunDir)) {
        throw new Error("run directory escapes the authorized runs root");
      }
      const stateDir = realpathSync(join(canonicalRunDir, ".omx", "state"));
      if (!isCanonicalPathWithin(canonicalRunDir, stateDir)) {
        throw new Error("state directory escapes the authorized run directory");
      }
      const session = JSON.parse(await readFile(join(stateDir, "session.json"), "utf-8")) as Record<string, unknown>;
      if (session.session_id !== record.session_id) throw new Error("run session pointer changed");
      const sessionDir = realpathSync(join(stateDir, "sessions", record.session_id));
      if (!isCanonicalPathWithin(stateDir, sessionDir)) {
        throw new Error("session directory escapes the authorized state directory");
      }
      candidates.push({ sessionDir, sessionId: record.session_id, record });
    } catch (err) {
      throw new Error(`Refusing cancellation because detached run authority is invalid: ${record.run_dir}.`, { cause: err });
    }
  }

  if (candidates.length > 1) throw new Error("Refusing cancellation because multiple detached run authorities match.");
  if (candidates.length === 0) return null;
  const [{ sessionDir, sessionId, record }] = candidates;
  const refs: ModeStateFileRef[] = [];
  const stateFiles = await readdir(sessionDir).catch(() => [] as string[]);
  for (const file of stateFiles) {
    if (!isModeStateFilename(file)) continue;
    const path = join(sessionDir, file);
    try {
      const fileStat = lstatSync(path);
      if (!fileStat.isFile() || fileStat.isSymbolicLink()) {
        throw new Error(`Refusing cancellation through non-regular run state target: ${path}.`);
      }
      const canonicalFile = realpathSync(path);
      if (!isCanonicalPathWithin(sessionDir, canonicalFile)) {

View on GitHub (pinned to 3ad79a8a6f)

Solutions

1. Read err.cause to identify which specific validation failed and fix that (see the chained error)
2. Restore/clean the record's run dir state, or delete the invalid detached active record
3. Re-run cancellation once authority is consistent

try { await cancelDetached(...); } catch (e) {
  if (/detached run authority is invalid/.test((e as Error).message)) {
    const cause = (e as Error).cause; // fix the specific 213-216 issue, remove stale record, retry
  }
}

When it happens

Trigger: Any throw inside the try block validating a record's run dir/state/session chain: escaping paths, changed session pointer, unreadable session.json, or missing directories.

Common situations: Moved projects/runs roots, symlinked .omx internals, corrupted state after a crash, or permission loss on state files.

Related errors

• invalid auth slot name: use 1-64 letters, numbers, '.', '_'
• agents-init target must stay inside the current working dire
• invalid detached leader parent environment
• run directory escapes the authorized runs root
• state directory escapes the authorized run directory

AI-assisted analysis of Yeachan-Heo/oh-my-codex@3ad79a8a6f (2026-08-27). Data as JSON: /api/errors/0e2a594f075b648b. Report an issue: GitHub.