{"record":{"id":"836a1f2713493dc1","repo":"vercel/ai","slug":"the-codex-harness-cannot-use-mintbridgetoken-wit","errorCode":null,"errorMessage":"The codex harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id.","messagePattern":"The codex harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id\\.","errorType":"exception","errorClass":"HarnessCapabilityUnsupportedError","httpStatus":null,"severity":"error","filePath":"packages/harness-codex/src/codex-harness.ts","lineNumber":236,"sourceCode":"        startOpts.permissionMode !== 'allow-all'\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'codex' does not support built-in tool approval requests; use permissionMode: 'allow-all'.\",\n          harnessId: 'codex',\n        });\n      }\n      const sandboxSession = startOpts.sandboxSession;\n      const toolSafeSandboxSession =\n        getRestrictedSandboxSession(sandboxSession);\n      const sandboxId = 'id' in sandboxSession ? sandboxSession.id : undefined;\n      validateBasicSandboxSettings({\n        sandboxSession,\n        port: settings.port,\n        portEndpoint: settings.portEndpoint,\n      });\n      if (settings.mintBridgeToken != null && sandboxId == null) {\n        throw new HarnessCapabilityUnsupportedError({\n          harnessId: 'codex',\n          message:\n            'The codex harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id.',\n        });\n      }\n      const defaultWorkingDirectory =\n        await resolveSandboxDefaultWorkingDirectory({\n          sandboxSession,\n          abortSignal: startOpts.abortSignal,\n        });\n      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;\n      const isResume = lifecycleState != null;\n      const isContinue = startOpts.continueFrom != null;\n      const resumeData =\n        isResume && typeof lifecycleState?.data === 'object'\n          ? (lifecycleState.data as {\n              threadId?: unknown;\n              turnConfigurationFingerprint?: unknown;","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/harness-codex/src/codex-harness.ts#L218-L254","documentation":"When settings.mintBridgeToken is configured, the codex harness must know the sandbox session id to mint a bridge token scoped to that session. If the resolved sandboxId is null (the sandbox session does not expose an id), it throws HarnessCapabilityUnsupportedError.","triggerScenarios":"createCodex({ mintBridgeToken: ... }) combined with a sandboxSession object that lacks an id property, during doStart validation.","commonSituations":"Using a minimal/custom sandbox session implementation that omits id; constructing a SandboxSession stub in tests without an id while enabling bridge token minting.","solutions":["Use a sandbox session that exposes an `id` property when mintBridgeToken is configured.","Drop the mintBridgeToken setting if the sandbox does not track session ids.","Create the sandbox through the supported provider API so a session id is assigned."],"exampleFix":"// before\ncreateCodex({ sandboxSession: { getPortEndpoint }, mintBridgeToken: true });\n// after\ncreateCodex({ sandboxSession: { id: 'sess_123', getPortEndpoint }, mintBridgeToken: true });","handlingStrategy":"validation","validationCode":"if (settings.mintBridgeToken != null && (sandboxSession == null || !('id' in sandboxSession) || sandboxSession.id == null)) {\n  throw new Error('mintBridgeToken requires a sandbox session with an id');\n}","typeGuard":"function hasSessionId(s) {\n  return typeof s === 'object' && s !== null && 'id' in s && typeof s.id === 'string' && s.id.length > 0;\n}","tryCatchPattern":"try {\n  const session = await codex.start({});\n} catch (e) {\n  if (/mintBridgeToken.*does not expose an id/.test(String(e?.message))) {\n    // recreate sandbox with an id-bearing session or drop mintBridgeToken\n  } else throw e;\n}","preventionTips":["Only enable mintBridgeToken with provider-managed sandbox sessions","Assert session id presence in sandbox factory code","Avoid hand-rolled SandboxSession stubs in production paths"],"tags":["harness-codex","sandbox","bridge-token","unsupported-capability"],"backgroundTag":"unsupported-capability","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}