{"record":{"id":"288f73e6e4cce8b8","repo":"openclaw/openclaw","slug":"a-codex-auth-file-exists-at-authpath-but-agent","errorCode":null,"errorMessage":"A Codex auth file exists at ${authPath}, but agent-scoped Codex runs use OpenClaw's auth store and do not read that file. Preview only that credential import with `openclaw migrate plan codex --from <codex-home> --agent ${targetAgentId} --include-secrets --item auth:openai`, then run `openclaw migrate apply codex --from <codex-home> --agent ${targetAgentId} --include-secrets --item auth:openai --yes`. If the plan finds no credentials, remove the stale auth file.","messagePattern":"A Codex auth file exists at (.+?), but agent-scoped Codex runs use OpenClaw's auth store and do not read that file\\. Preview only that credential import with `openclaw migrate plan codex --from <codex-home> --agent (.+?) --include-secrets --item auth:openai`, then run `openclaw migrate apply codex --from <codex-home> --agent (.+?) --include-secrets --item auth:openai --yes`\\. If the plan finds no credentials, remove the stale auth file\\.","errorType":"exception","errorClass":"AgentHarnessPreflightError","httpStatus":null,"severity":"error","filePath":"extensions/codex/src/app-server/auth-bridge.ts","lineNumber":145,"sourceCode":"\nfunction assertNoUnimportedAgentCodexAuthFile(params: {\n  startOptions: CodexAppServerStartOptions;\n  agentId?: string;\n  agentDir: string;\n  authRequirement?: CodexAppServerAuthRequirement;\n}): void {\n  // Ephemeral managed starts cannot load this stale file, and the shared-client key\n  // separates auth requirements plus fallback identities. Preserve the supported\n  // stdio API-key login instead of turning a leftover file into a hard failure.\n  if (\n    params.authRequirement === \"api-key\" &&\n    resolveCodexAppServerFallbackApiKeyCacheKey({ startOptions: params.startOptions })\n  ) {\n    return;\n  }\n  const message = resolveUnimportedAgentCodexAuthMessage(params);\n  if (message) {\n    throw new AgentHarnessPreflightError(message);\n  }\n}\n\nfunction resolveUnimportedAgentCodexAuthMessage(params: {\n  startOptions: CodexAppServerStartOptions;\n  agentId?: string;\n  agentDir: string;\n}): string | undefined {\n  const managedCodexCli =\n    params.startOptions.commandSource === \"managed\" ||\n    params.startOptions.commandSource === \"resolved-managed\";\n  if (\n    params.startOptions.transport !== \"stdio\" ||\n    !managedCodexCli ||\n    params.startOptions.homeScope === \"user\"\n  ) {\n    return undefined;\n  }","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/openclaw/openclaw/blob/01804a75319da4b69c9ab98ceaa30477e22b8c0b/extensions/codex/src/app-server/auth-bridge.ts#L127-L163","documentation":"Error \"A Codex auth file exists at ${authPath}, but agent-scoped Codex runs use OpenClaw's auth store and do not read that file. Preview only that credential import with `openclaw migrate plan codex --from <codex-home> --agent ${targetAgentId} --include-secrets --item auth:openai`, then run `openclaw migrate apply codex --from <codex-home> --agent ${targetAgentId} --include-secrets --item auth:openai --yes`. If the plan finds no credentials, remove the stale auth file.\" thrown in openclaw/openclaw.","triggerScenarios":"Thrown at extensions/codex/src/app-server/auth-bridge.ts:145 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01804a75319da4b69c9ab98ceaa30477e22b8c0b","analyzedAt":"2026-08-12T04:37:58.197Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}