{"record":{"id":"1222ccf99923746b","repo":"openai/codex","slug":"ws-shared-secret-file-ws-issuer-ws-au","errorCode":null,"errorMessage":"`--ws-shared-secret-file`, `--ws-issuer`, `--ws-audience`, and `--ws-max-clock-skew-seconds` require `--ws-auth signed-bearer-token`","messagePattern":"`--ws-shared-secret-file`, `--ws-issuer`, `--ws-audience`, and `--ws-max-clock-skew-seconds` require `--ws-auth signed-bearer-token`","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server-transport/src/transport/auth.rs","lineNumber":153,"sourceCode":"}\n\nimpl AppServerWebsocketAuthArgs {\n    pub fn try_into_settings(self) -> anyhow::Result<AppServerWebsocketAuthSettings> {\n        let normalize = |value: Option<String>| {\n            value.and_then(|value| {\n                let trimmed = value.trim();\n                (!trimmed.is_empty()).then(|| trimmed.to_string())\n            })\n        };\n\n        let config = match self.ws_auth {\n            Some(WebsocketAuthCliMode::CapabilityToken) => {\n                if self.ws_shared_secret_file.is_some()\n                    || self.ws_issuer.is_some()\n                    || self.ws_audience.is_some()\n                    || self.ws_max_clock_skew_seconds.is_some()\n                {\n                    anyhow::bail!(\n                        \"`--ws-shared-secret-file`, `--ws-issuer`, `--ws-audience`, and `--ws-max-clock-skew-seconds` require `--ws-auth signed-bearer-token`\"\n                    );\n                }\n                let source = match (self.ws_token_file, self.ws_token_sha256) {\n                    (Some(_), Some(_)) => {\n                        anyhow::bail!(\n                            \"`--ws-token-file` and `--ws-token-sha256` are mutually exclusive\"\n                        );\n                    }\n                    (Some(token_file), None) => {\n                        AppServerWebsocketCapabilityTokenSource::TokenFile {\n                            token_file: absolute_path_arg(\"--ws-token-file\", token_file)?,\n                        }\n                    }\n                    (None, Some(token_sha256)) => {\n                        AppServerWebsocketCapabilityTokenSource::TokenSha256 {\n                            token_sha256: sha256_digest_arg(\"--ws-token-sha256\", &token_sha256)?,\n                        }","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server-transport/src/transport/auth.rs#L135-L171","documentation":"Error \"`--ws-shared-secret-file`, `--ws-issuer`, `--ws-audience`, and `--ws-max-clock-skew-seconds` require `--ws-auth signed-bearer-token`\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/app-server-transport/src/transport/auth.rs:153 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}