{"record":{"id":"1a017c166bb8f57c","repo":"coleam00/Archon","slug":"codex-env-vars-not-set-but-persisted-pers","errorCode":null,"errorMessage":"⚠️  CODEX_* env vars not set, but persisted ${persistedAuthPath} exists from a previous run","messagePattern":"⚠️  CODEX_\\* env vars not set, but persisted (.+?) exists from a previous run","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/server/src/scripts/setup-auth.ts","lineNumber":38,"sourceCode":"  last_refresh: string;\n}\n\nfunction setupAuth(): void {\n  // Get environment variables\n  const idToken = process.env.CODEX_ID_TOKEN;\n  const accessToken = process.env.CODEX_ACCESS_TOKEN;\n  const refreshToken = process.env.CODEX_REFRESH_TOKEN;\n  const accountId = process.env.CODEX_ACCOUNT_ID;\n\n  // No CODEX_* env vars provided: warn if a persisted auth.json already\n  // exists on the volume (may be stale), otherwise skip with \"unavailable\".\n  if (!idToken || !accessToken || !refreshToken || !accountId) {\n    // /home/appuser is now persisted across restarts in Docker, so a stale\n    // auth.json from a previous run with creds is not automatically wiped.\n    // Surface this so operators don't end up with Codex silently using old/revoked tokens.\n    const persistedAuthPath = path.join(os.homedir(), '.codex', 'auth.json');\n    if (fs.existsSync(persistedAuthPath)) {\n      console.warn(\n        `⚠️  CODEX_* env vars not set, but persisted ${persistedAuthPath} exists from a previous run`\n      );\n      console.warn(\n        '    Codex will attempt to use those credentials. If they are stale or revoked,'\n      );\n      console.warn(\n        '    delete the file inside the container or wipe the archon_user_home volume to reset.'\n      );\n      return;\n    }\n    console.log('⏭️  Skipping Codex auth setup - credentials not provided');\n    console.log('   Codex assistant will be unavailable');\n    return;\n  }\n\n  console.log('🔐 Setting up Codex authentication...');\n\n  // Create auth.json structure","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/server/src/scripts/setup-auth.ts#L20-L56","documentation":"setupAuth found no CODEX_* credentials in the environment, but a persisted ~/.codex/auth.json from a previous run still exists (the Docker home directory survives restarts). Because Codex will silently reuse those possibly stale or revoked tokens, the script warns the operator instead of skipping quietly.","triggerScenarios":"Running the setup-auth script with idToken/accessToken/refreshToken/accountId all unset while fs.existsSync(os.homedir()/.codex/auth.json) is true from an earlier run.","commonSituations":"Container restart where CODEX_* env vars were removed from the deployment config; rotating credentials but forgetting the persisted volume; shared archon_user_home volume reused across deployments.","solutions":["Set the CODEX_* env vars so fresh credentials are written over the persisted auth.json","Delete the stale file: remove ~/.codex/auth.json inside the container","Wipe the archon_user_home volume to reset the persisted home","Verify the persisted credentials still work if you intend to keep using them"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nconst stale = !process.env.CODEX_ACCESS_TOKEN && fs.existsSync(path.join(os.homedir(), '.codex', 'auth.json'));","typeGuard":"function hasFreshCodexEnv(env: NodeJS.ProcessEnv = process.env): boolean {\n  return Boolean(env.CODEX_ID_TOKEN && env.CODEX_ACCESS_TOKEN && env.CODEX_REFRESH_TOKEN && env.CODEX_ACCOUNT_ID);\n}","tryCatchPattern":"null","preventionTips":["Before deploying, confirm CODEX_* env vars are present whenever a persisted archon_user_home volume is used","After rotating credentials, delete ~/.codex/auth.json or wipe the volume","Alert on container restarts where env config changed but the home volume persisted","Treat the setup-auth stale-auth warning as an action item, not noise"],"tags":["auth","codex","docker","persisted-state","setup"],"backgroundTag":"stale-credentials","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}