{"record":{"id":"174f1ef153878eff","repo":"openai/codex","slug":"environment-variable-env-var-name-is-empty","errorCode":null,"errorMessage":"environment variable `{env_var_name}` is empty","messagePattern":"environment variable `(.+?)` is empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/cli/src/main.rs","lineNumber":2550,"sourceCode":"    mode: AppServerRemoteControlMode,\n) -> anyhow::Result<()> {\n    let output = codex_app_server_daemon::set_remote_control(mode).await?;\n    println!(\"{}\", serde_json::to_string(&output)?);\n    Ok(())\n}\n\nfn read_remote_auth_token_from_env_var_with<F>(\n    env_var_name: &str,\n    get_var: F,\n) -> anyhow::Result<String>\nwhere\n    F: FnOnce(&str) -> Result<String, std::env::VarError>,\n{\n    let auth_token = get_var(env_var_name)\n        .map_err(|_| anyhow::anyhow!(\"environment variable `{env_var_name}` is not set\"))?;\n    let auth_token = auth_token.trim().to_string();\n    if auth_token.is_empty() {\n        anyhow::bail!(\"environment variable `{env_var_name}` is empty\");\n    }\n    Ok(auth_token)\n}\n\nfn read_remote_auth_token_from_env_var(env_var_name: &str) -> anyhow::Result<String> {\n    read_remote_auth_token_from_env_var_with(env_var_name, |name| std::env::var(name))\n}\n\nasync fn run_interactive_tui(\n    mut interactive: TuiCli,\n    remote: Option<String>,\n    remote_auth_token_env: Option<String>,\n    arg0_paths: Arg0DispatchPaths,\n) -> std::io::Result<AppExitInfo> {\n    if let Some(prompt) = interactive.prompt.take() {\n        // Normalize CRLF/CR to LF so CLI-provided text can't leak `\\r` into TUI state.\n        interactive.prompt = Some(prompt.replace(\"\\r\\n\", \"\\n\").replace('\\r', \"\\n\"));\n    }","sourceCodeStart":2532,"sourceCodeEnd":2568,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/cli/src/main.rs#L2532-L2568","documentation":"The same token reader as the not-set case (read_remote_auth_token_from_env_var_with), reached when the variable exists but its value trims to zero length (auth_token.trim()). codex rejects blank tokens up front because an empty credential would only fail later at the remote server, far from the actual cause.","triggerScenarios":"`export CODEX_REMOTE_TOKEN=''` (or a whitespace-only value) combined with `codex --remote ... --remote-auth-token-env CODEX_REMOTE_TOKEN`.","commonSituations":"CI secret defined but empty (not yet created, or masked to blank); `VAR=` with no value in a .env file; `export TOKEN=$(cat missing-file)` capturing nothing; a secret manager returning an empty string.","solutions":["Set a real value: `export CODEX_REMOTE_TOKEN=<token>`.","When sourcing from a file, fail fast on empty: `test -s token.txt || exit 1` before exporting.","In CI, assert the secret is non-empty before the codex step runs."],"exampleFix":"# before\nexport CODEX_REMOTE_TOKEN=$(cat /missing/path)   # captures nothing -> empty\ncodex --remote wss://host --remote-auth-token-env CODEX_REMOTE_TOKEN\n# after\nexport CODEX_REMOTE_TOKEN=$(cat /path/to/token)      # non-empty after trim\ntest -n \"$CODEX_REMOTE_TOKEN\" || exit 1","handlingStrategy":"validation","validationCode":"token_is_blank() { [[ -z ${1//[[:space:]]/} ]]; }\nif token_is_blank \"${CODEX_REMOTE_TOKEN:-}\"; then\n  echo \"CODEX_REMOTE_TOKEN is blank; refusing to start codex\" >&2; exit 2\nfi\ncodex --remote wss://exec.example.com --remote-auth-token-env CODEX_REMOTE_TOKEN","typeGuard":null,"tryCatchPattern":"if ! codex --remote wss://host --remote-auth-token-env CODEX_REMOTE_TOKEN 2>err.log; then\n  grep -q 'environment variable `CODEX_REMOTE_TOKEN` is empty' err.log && exit 2   # set a real value, then rerun\n  exit 1\nfi","preventionTips":["Never default a token variable to an empty string","Assert secrets are non-empty in CI before the step that consumes them","When reading tokens from files, verify the file is non-empty at read time (test -s)"],"tags":["cli","codex","environment-variable","auth-token","remote"],"backgroundTag":"empty-env-var","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}