{"record":{"id":"1932733f3dc44b7a","repo":"usestrix/strix","slug":"unavailable","errorCode":"unavailable","errorMessage":"unavailable: {exc}","messagePattern":"unavailable: (.+?)","errorType":"error_code","errorClass":"CodexAuthError","httpStatus":null,"severity":"error","filePath":"strix/config/codex.py","lineNumber":232,"sourceCode":"    values = query.get(key)\n    return values[0] if values else None\n\n\ndef _post_form(payload: dict[str, str]) -> dict[str, Any]:\n    detail = \"\"\n    try:\n        with requests.post(\n            TOKEN_URL,\n            data=payload,\n            headers={\"Accept\": \"application/json\"},\n            timeout=_TOKEN_TIMEOUT,\n        ) as response:\n            status_code = response.status_code\n            body = response.content\n            if status_code >= 400:\n                detail = response.text[:300]\n    except requests.RequestException as exc:\n        raise CodexAuthError(\"unavailable\", str(exc)) from exc\n    if status_code >= 400:\n        raise CodexAuthError(\"token_http_error\", f\"HTTP {status_code}: {detail}\")\n    data = json.loads(body or b\"{}\")\n    if not isinstance(data, dict):\n        raise CodexAuthError(\"bad_response\", \"token endpoint returned non-object\")\n    return data\n\n\ndef _record_from_token_response(\n    data: dict[str, Any], refresh_fallback: str | None = None\n) -> dict[str, Any]:\n    access = data.get(\"access_token\")\n    # A refresh response may omit refresh_token when it isn't rotated; keep the old one.\n    refresh = data.get(\"refresh_token\") or refresh_fallback\n    expires_in = data.get(\"expires_in\")\n    if not isinstance(access, str) or not access:\n        raise CodexAuthError(\"bad_response\", \"token response missing access_token\")\n    if not isinstance(refresh, str) or not refresh:","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/usestrix/strix/blob/85513391305171ecc6faffe03da4a8bda5e3febb/strix/config/codex.py#L214-L250","documentation":"CodexAuthError with code `unavailable` is raised when the HTTP request to OpenAI's OAuth token endpoint (https://auth.openai.com/oauth/token) fails at the transport layer — DNS failure, connection refused, TLS error, or timeout (30s). It signals a network/availability problem, not an auth problem: the request never got an HTTP response.","triggerScenarios":"Any call to `exchange_code(code, verifier)` during `strix auth login` or `refresh_tokens(refresh_token)` during token refresh, when `requests.post(TOKEN_URL, ...)` raises a `requests.RequestException` (ConnectionError, Timeout, SSLError) — e.g. no internet, corporate proxy blocking auth.openai.com, or the endpoint being down.","commonSituations":"Running scans on an air-gapped or proxied network; VPN dropping mid-refresh; transient auth.openai.com outages; misconfigured HTTPS_PROXY/HTTP_PROXY env vars; captive portals.","solutions":["Check connectivity to the endpoint: `curl -I https://auth.openai.com/oauth/token` from the same machine/user","Configure proxy env vars (HTTPS_PROXY) if a corporate proxy is required, or排除 auth.openai.com from proxy blocking","Retry the operation — this is a transient availability error; re-run `strix auth login` or let the next `get_valid_token()` call retry refresh","If the outage persists, switch the scan to an API-key provider (non-Codex LLM config) until auth.openai.com is reachable"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"import socket, urllib.parse\n\ndef token_endpoint_reachable(timeout: float = 5.0) -> bool:\n    host = urllib.parse.urlparse(\"https://auth.openai.com\").hostname\n    try:\n        socket.create_connection((host, 443), timeout=timeout).close()\n        return True\n    except OSError:\n        return False","typeGuard":null,"tryCatchPattern":"from strix.config.codex import CodexAuthError, get_valid_token\n\ntry:\n    access, account = get_valid_token()\nexcept CodexAuthError as e:\n    if e.code == \"unavailable\":\n        # transport-level failure: safe to retry with backoff\n        ...  # schedule retry / surface 'check network' to user\n    raise","preventionTips":["Ensure outbound HTTPS to auth.openai.com is allowed (proxy env vars set) before starting scans","Wrap get_valid_token() with a small retry-with-backoff for code 'unavailable' — it is transient by nature","Run `strix auth login` on a known-good network so the stored token starts fresh and refreshes rarely"],"tags":["network","oauth","auth","codex","proxy"],"backgroundTag":null,"analyzedSha":"85513391305171ecc6faffe03da4a8bda5e3febb","analyzedAt":"2026-08-15T05:03:57.275Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}