{"record":{"id":"50c9b90eaddc720d","repo":"Hmbown/CodeWhale","slug":"codex-access-token-in-is-expired-read-only-con","errorCode":null,"errorMessage":"Codex access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `codex login`, or provide OPENAI_CODEX_ACCESS_TOKEN for this process.","messagePattern":"Codex access token in (.+?) is expired\\. Read-only consent never refreshes or rewrites another CLI's credentials\\. Run `codex login`, or provide OPENAI_CODEX_ACCESS_TOKEN for this process\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/oauth.rs","lineNumber":167,"sourceCode":"#[must_use]\npub fn stored_credentials_present(grant: &ExternalCredentialReadGrant) -> bool {\n    load_credentials(grant)\n        .ok()\n        .flatten()\n        .is_some_and(|credentials| !token_is_expired(&credentials.access_token))\n}\n\n/// Load read-only credentials from the exact external path authorized by\n/// `grant`. Expired tokens fail with guidance; they are never refreshed.\npub fn get_credentials(grant: &ExternalCredentialReadGrant) -> Result<CodexCredentials> {\n    let creds = load_credentials(grant)?.with_context(missing_auth_message)?;\n\n    // Check if the access token is still valid.\n    if !token_is_expired(&creds.access_token) {\n        return Ok(creds);\n    }\n\n    bail!(\n        \"Codex access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `codex login`, or provide OPENAI_CODEX_ACCESS_TOKEN for this process.\",\n        codewhale_config::quote_os_path(grant.path())\n    )\n}\n\n#[must_use]\npub fn missing_auth_message() -> String {\n    format!(\n        \"OpenAI Codex OAuth credentials are unavailable.\\n\\\n         \\n\\\n         Codewhale checks OPENAI_CODEX_ACCESS_TOKEN and CODEX_ACCESS_TOKEN automatically.\\n\\\n         Access to the Codex CLI file is disabled by default. After `codex login`, grant read-only access explicitly with:\\n\\\n         `codewhale auth external-consent --provider openai-codex --mode read-only --path {}`\\n\\\n         Read-only access never refreshes or rewrites the Codex CLI file.\",\n        codewhale_config::quote_os_path(&auth_file_path())\n    )\n}\n","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/oauth.rs#L149-L185","documentation":"get_credentials found stored Codex credentials whose access token is past expiry. By design the integration only reads another CLI's auth file read-only — it never refreshes or rewrites those tokens — so the fix is external: re-login with codex or inject a fresh token via OPENAI_CODEX_ACCESS_TOKEN.","triggerScenarios":"Thrown at crates/tui/src/oauth.rs:167 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run codex login to refresh the external CLI's credentials","Or export OPENAI_CODEX_ACCESS_TOKEN with a valid token for this process"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}