{"record":{"id":"01977ab29553052e","repo":"openai/codex","slug":"invalid-cloud-config-fragment-fragment-message","errorCode":null,"errorMessage":"invalid cloud config fragment {fragment}: {message}","messagePattern":"invalid cloud config fragment (.+?): (.+?)","errorType":"validation","errorClass":"CloudConfigLayerError","httpStatus":null,"severity":"error","filePath":"codex-rs/config/src/cloud_config_layers.rs","lineNumber":61,"sourceCode":"pub struct CloudConfigFragmentSource {\n    pub id: String,\n    pub name: String,\n}\n\nimpl fmt::Display for CloudConfigFragmentSource {\n    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n        write!(f, \"{} ({})\", self.name, self.id)\n    }\n}\n\n#[derive(Debug, Error, PartialEq, Eq)]\npub enum CloudConfigLayerError {\n    #[error(\"failed to parse cloud config fragment {fragment}: {message}\")]\n    Parse {\n        fragment: CloudConfigFragmentSource,\n        message: String,\n    },\n    #[error(\"invalid cloud config fragment {fragment}: {message}\")]\n    Invalid {\n        fragment: CloudConfigFragmentSource,\n        message: String,\n    },\n}\n\npub fn cloud_config_layers_from_fragments(\n    fragments: impl IntoIterator<Item = CloudConfigFragment>,\n    base_dir: &AbsolutePathBuf,\n) -> Result<Vec<ConfigLayerEntry>, CloudConfigLayerError> {\n    cloud_config_layers_from_fragments_impl(fragments, base_dir, /*strict_config*/ false)\n}\n\npub(crate) fn cloud_config_layers_from_fragments_strict(\n    fragments: impl IntoIterator<Item = CloudConfigFragment>,\n    base_dir: &AbsolutePathBuf,\n) -> Result<Vec<ConfigLayerEntry>, CloudConfigLayerError> {\n    cloud_config_layers_from_fragments_impl(fragments, base_dir, /*strict_config*/ true)","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/config/src/cloud_config_layers.rs#L43-L79","documentation":"CloudConfigLayerError::Invalid is returned by cloud_config_layers_from_fragments (and its _strict variant) in codex-rs/config/src/cloud_config_layers.rs when an enterprise cloud-delivered config fragment is valid TOML but its contents are rejected downstream: either resolve_relative_paths_in_config_toml fails on a path-typed field, or strict mode finds fields that do not exist on ConfigToml. The {fragment} placeholder renders as 'name (id)', identifying exactly which bundle entry is bad.","triggerScenarios":"Calling cloud_config_layers_from_fragments / cloud_config_layers_from_fragments_strict with a CloudConfigFragment whose contents contains a path field that cannot be resolved against base_dir, or (strict mode) an unknown or mistyped key such as 'approvals' that ConfigToml does not recognize; the fragment set comes from a cloud/enterprise config bundle in backend priority order.","commonSituations":"An org admin publishes a managed fragment with a typo'd key or an invalid relative path; version skew where the local codex build's ConfigToml schema predates a new fragment key; base_dir changing after CODEX_HOME moves.","solutions":["Read the fragment name and id in the message, fix the reported field in that managed fragment in the admin console, and republish","If the message concerns a path, make the path field valid and resolvable against the cloud config base directory (or absolute)","If strict mode reports an unknown field, remove the typo'd or unsupported key from the fragment","Update codex to a version whose ConfigToml schema includes the fragment field if the field is legitimately new"],"exampleFix":"# fragment contents (before)\nmodel = \"gpt-5.1-codex\"\napprovals = \"never\"        # unknown key -> Invalid in strict mode\n\n# fragment contents (after)\nmodel = \"gpt-5.1-codex\"\napproval_policy = \"never\"","handlingStrategy":"try-catch","validationCode":"// Pre-flight a fragment before handing it to the layer builder\nlet value: toml::Value = toml::from_str(&fragment.contents)\n    .map_err(|e| format!(\"fragment {} is not valid TOML: {e}\", fragment.name))?;\n// strict mode: also reject keys ConfigToml does not know before submitting","typeGuard":null,"tryCatchPattern":"match cloud_config_layers_from_fragments(fragments, &base_dir) {\n    Ok(layers) => { /* push onto stack */ }\n    Err(CloudConfigLayerError::Invalid { fragment, message }) => {\n        tracing::error!(\"managed fragment {} ({}) rejected: {message}\", fragment.name, fragment.id);\n        // surface to the IT admin; do not silently drop the managed layer\n    }\n    Err(CloudConfigLayerError::Parse { .. }) => { /* handle syntax error */ }\n}","preventionTips":["Lint managed fragments with a strict ConfigToml parse in the admin console before publishing","Keep client codex versions in lockstep with the fragment schema the org publishes","Pre-validate that path fields in fragments resolve against the intended base_dir"],"tags":["config","cloud-config","enterprise","toml","path-resolution","rust"],"backgroundTag":"config-validation-failed","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}