{"record":{"id":"49e119adc62eb392","repo":"openai/codex","slug":"strict-config-is-not-supported-for-codex-sub","errorCode":null,"errorMessage":"`--strict-config` is not supported for `codex {subcommand}`","messagePattern":"`--strict-config` is not supported for `codex (.+?)`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"codex-rs/cli/src/main.rs","lineNumber":2471,"sourceCode":"fn reject_strict_config_for_app_server_subcommand(\n    strict_config: bool,\n    subcommand: Option<&AppServerSubcommand>,\n) -> anyhow::Result<()> {\n    if subcommand.is_none() {\n        return Ok(());\n    }\n    reject_strict_config_for_unsupported_subcommand(\n        strict_config,\n        app_server_subcommand_name(subcommand),\n    )\n}\n\nfn reject_strict_config_for_unsupported_subcommand(\n    strict_config: bool,\n    subcommand: &str,\n) -> anyhow::Result<()> {\n    if strict_config {\n        anyhow::bail!(\"`--strict-config` is not supported for `codex {subcommand}`\");\n    }\n    Ok(())\n}\n\nfn reject_remote_mode_for_app_server_subcommand(\n    remote: Option<&str>,\n    remote_auth_token_env: Option<&str>,\n    subcommand: Option<&AppServerSubcommand>,\n) -> anyhow::Result<()> {\n    let subcommand_name = app_server_subcommand_name(subcommand);\n    reject_remote_mode_for_subcommand(remote, remote_auth_token_env, subcommand_name)\n}\n\nfn app_server_subcommand_name(subcommand: Option<&AppServerSubcommand>) -> &'static str {\n    match subcommand {\n        None => \"app-server\",\n        Some(AppServerSubcommand::Daemon(daemon)) => match daemon.subcommand {\n            AppServerDaemonSubcommand::Bootstrap(_) => \"app-server daemon bootstrap\",","sourceCodeStart":2453,"sourceCodeEnd":2489,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/cli/src/main.rs#L2453-L2489","documentation":"`--strict-config` makes codex fail on unknown config keys, but only some commands honor it. The flag is parsed at the root level (so `codex --strict-config` keeps working for the TUI and for wrappers that forward root options), so unsupported subcommands get an explicit post-parse reject: reject_root_strict_config_for_subcommand consults unsupported_subcommand_name_for_strict_config and reject_strict_config_for_unsupported_subcommand bails rather than silently accepting a flag the subcommand would ignore. Supported commands include the TUI, exec, resume, agents, review, doctor, and bare `app-server`; mcp, plugin, login, logout, cloud, sandbox, debug, apply, update, and `app-server <sub>` are rejected.","triggerScenarios":"Running `codex --strict-config mcp ...`, `codex --strict-config login`, `codex --strict-config cloud ...`, or `codex --strict-config app-server generate-ts` — any subcommand for which unsupported_subcommand_name_for_strict_config returns Some(...). Commands it returns None for (exec, resume, agents, review, doctor, queue, fork, bare app-server, ...) never trigger it.","commonSituations":"CI pipelines that prepend --strict-config globally to catch config.toml typos and then also call `codex mcp add` or `codex login` in the same job; wrapper scripts forwarding a shared root-option string into every subcommand; playbooks written against an older codex that accepted the flag more broadly.","solutions":["Drop `--strict-config` from invocations of the subcommand named in the error.","Use the flag only with supported commands: the TUI (`codex --strict-config`), `codex exec`, `codex resume`, `codex agents`, `codex review`, `codex doctor`, bare `codex app-server`.","In CI, validate config strictly once with a supported command, then run the remaining subcommands without the flag."],"exampleFix":"# before\ncodex --strict-config mcp add fs --command npx -y @modelcontextprotocol/server-filesystem\n# after\ncodex mcp add fs --command npx -y @modelcontextprotocol/server-filesystem\n\n# strict config stays on commands that support it:\ncodex exec --strict-config 'ping'","handlingStrategy":"validation","validationCode":"strict_config_ok() {\n  case \"$1\" in\n    \"\"|tui|exec|resume|agents|review|doctor|mcp-server|exec-server|app-server) return 0 ;;\n    *) return 1 ;;\n  esac\n}\nif [[ -n $STRICT ]]; then\n  strict_config_ok \"$SUB\" || { echo \"--strict-config unsupported for 'codex $SUB'\" >&2; exit 2; }\nfi\ncodex ${STRICT:+--strict-config} \"$SUB\" \"$@\"","typeGuard":null,"tryCatchPattern":"if ! codex --strict-config mcp list 2>err.log; then\n  grep -q -- '--strict-config` is not supported for' err.log && exec codex mcp list\n  exit 1\nfi","preventionTips":["Scope --strict-config to the commands that consume it instead of a global prefix","Encode the supported-subcommand list in one wrapper constant so upgrades refresh it in one place","Let CI run strict validation once via a supported command rather than on every codex call"],"tags":["cli","codex","flag-validation","strict-config"],"backgroundTag":"unsupported-cli-flag","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}