{"record":{"id":"8e7186c6d5c11e6d","repo":"openai/codex","slug":"current-time-request-timed-out-after-s","errorCode":null,"errorMessage":"current-time request timed out after {}s","messagePattern":"current-time request timed out after (.+?)s","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server/src/current_time.rs","lineNumber":129,"sourceCode":"                thread_id: thread_id.to_string(),\n            }),\n            /*thread_id*/ None,\n        )\n        .await;\n\n    let result = match timeout_at(deadline, rx).await {\n        Ok(Ok(Ok(result))) => result,\n        Ok(Ok(Err(err))) => {\n            bail!(\n                \"current-time request failed: code={} message={}\",\n                err.code,\n                err.message\n            );\n        }\n        Ok(Err(err)) => bail!(\"current-time request was canceled: {err}\"),\n        Err(_) => {\n            let _canceled = outgoing.cancel_request(&request_id).await;\n            bail!(\n                \"current-time request timed out after {}s\",\n                CURRENT_TIME_REQUEST_TIMEOUT.as_secs()\n            );\n        }\n    };\n    let response: CurrentTimeReadResponse =\n        serde_json::from_value(result).context(\"invalid current-time response\")?;\n\n    DateTime::from_timestamp(response.current_time_at, 0)\n        .ok_or_else(|| anyhow!(\"current-time response is outside the supported range\"))\n}\n\nfn require_single_current_time_connection(connection_ids: &[ConnectionId]) -> Result<ConnectionId> {\n    // External clocks are not interchangeable, so do not choose one silently.\n    match connection_ids {\n        [connection_id] => Ok(*connection_id),\n        _ => bail!(\n            \"expected exactly one client subscribed to the thread, found {}\",","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server/src/current_time.rs#L111-L147","documentation":"The Bedrock model provider refreshes credentials by shelling out to the AWS CLI, and refresh() hard-requires the configured auth command to be the literal string 'aws'; anything else — a script path, /usr/bin/aws, or a wrapper — is rejected with ErrorKind::InvalidInput before any subprocess runs (codex-rs/model-provider/src/amazon_bedrock/auth_refresh.rs:30). The restriction exists because the refresh logic parses `aws` CLI output specifically.","triggerScenarios":"recover_from_unauthorized calling refresh() after a 401/403 from Bedrock when the provider config's auth refresh command is not exactly 'aws' — an absolute path, a wrapper script, or a renamed binary.","commonSituations":"Hardened configs that replace command names with absolute paths; credential-vending wrapper scripts; config copied from examples that use a custom executable.","solutions":["Set the Bedrock auth refresh command to exactly `aws` (bare command name) and ensure AWS CLI v2 is on PATH.","If you need a custom credential flow, use the provider's static credential or environment options instead of the refresh command.","Verify with `command -v aws` inside the environment the process actually runs in."],"exampleFix":"# before (model provider config)\nauth_refresh_command = \"/usr/local/bin/aws\"\n# after\nauth_refresh_command = \"aws\"","handlingStrategy":"validation","validationCode":"fn bedrock_refresh_config_ok(command: &str) -> bool {\n    command == \"aws\" && which::which(\"aws\").is_ok()\n}","typeGuard":null,"tryCatchPattern":"match refresh_handle.refresh().await {\n    Err(e) if e.kind() == std::io::ErrorKind::InvalidInput\n        && e.to_string().contains(\"must be `aws`\") =>\n    {\n        // fix provider config: command must be the bare 'aws' CLI name\n    }\n    r => r?,\n}","preventionTips":["Pin the Bedrock auth refresh command to the literal 'aws' in managed configs.","Pre-install AWS CLI v2 in images that use Bedrock providers.","Smoke-test provider config (including refresh) before relying on automatic recovery."],"tags":["bedrock","aws","auth","model-provider","rust"],"backgroundTag":"invalid-auth-refresh-config","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}