{"record":{"id":"9318818a44831414","repo":"paperclipai/paperclip","slug":"no-codex-credentials-provisioned-for-managed-home","errorCode":null,"errorMessage":"no Codex credentials provisioned for managed home \"${input.effectiveCodexHome}\" (no usable auth.json, OPENAI_API_KEY is empty, and the sandbox has no Codex login). Use a sandbox image that is signed in to Codex, configure a per-agent OPENAI_API_KEY, or sign in to Codex on the host with a ChatGPT subscription.","messagePattern":"no Codex credentials provisioned for managed home \"(.+?)\" \\(no usable auth\\.json, OPENAI_API_KEY is empty, and the sandbox has no Codex login\\)\\. Use a sandbox image that is signed in to Codex, configure a per-agent OPENAI_API_KEY, or sign in to Codex on the host with a ChatGPT subscription\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/adapters/codex-local/src/server/execute.ts","lineNumber":400,"sourceCode":"      await input.onLog(\n        \"stdout\",\n        `Using the sandbox's own Codex login; managed home \"${input.effectiveCodexHome}\" has no host credentials.\\n`,\n      );\n      return;\n    }\n    if (sandboxAuthJson === \"unknown\") {\n      // The probe failing is an operational problem, not evidence that the\n      // sandbox lacks a login — proceeding lets a genuinely credentialed\n      // sandbox run, and a credential-less one still fails at Codex's first\n      // request with the provider's own error.\n      await input.onLog(\n        \"stderr\",\n        `Could not verify the sandbox's Codex login (probe failed); proceeding. ` +\n          `If the sandbox has no credentials, Codex will fail at its first request.\\n`,\n      );\n      return;\n    }\n    throw new Error(\n      `no Codex credentials provisioned for managed home \"${input.effectiveCodexHome}\" ` +\n        `(no usable auth.json, OPENAI_API_KEY is empty, and the sandbox has no Codex login). ` +\n        `Use a sandbox image that is signed in to Codex, configure a per-agent OPENAI_API_KEY, ` +\n        `or sign in to Codex on the host with a ChatGPT subscription.`,\n    );\n  }\n\n  throw new Error(\n    `no Codex credentials provisioned for managed home \"${input.effectiveCodexHome}\" ` +\n      `(no usable auth.json and OPENAI_API_KEY is empty). ` +\n      `Sign in to Codex on the host with a ChatGPT subscription, or configure a per-agent ` +\n      `OPENAI_API_KEY.`,\n  );\n}\n\nasync function emitSandboxAuthPrecedenceWarningIfNeeded(input: {\n  runId: string;\n  target: MaybeResolvedExecutionTarget;","sourceCodeStart":382,"sourceCodeEnd":418,"githubUrl":"https://github.com/paperclipai/paperclip/blob/67001ec6eb96ae601aa27bc91d9b2415d665334a/packages/adapters/codex-local/src/server/execute.ts#L382-L418","documentation":"Thrown by ensureCodexCredentialsProvisioned (execute.ts) for a SANDBOX transport target. It fires when credential readiness says the managed Codex home is not ready, the target is a sandbox, and probeSandboxCodexAuthJson returned a definitive \"absent\" (not \"present\", not \"unknown\"). The message lists the three ways to satisfy Codex auth because neither the host, the env, nor the sandbox has credentials.","triggerScenarios":"evaluateCodexCredentialReadiness returns { managed: true, ready: false } (managed home set up but no usable auth.json and no OPENAI_API_KEY) AND target.kind===\"remote\" && target.transport===\"sandbox\" AND probeSandboxCodexAuthJson returns \"absent\".","commonSituations":"Fresh sandbox image that was never signed in to Codex; the host lost its ChatGPT-subscription login AND no per-agent OPENAI_API_KEY was configured AND the sandbox image has no baked-in auth.json.","solutions":["Build/use a sandbox image that is already signed in to Codex (auth.json baked in).","Configure a per-agent OPENAI_API_KEY in the agent's env so the run authenticates regardless of host/sandbox login state.","Sign in to Codex on the host with a ChatGPT subscription so the managed home auth.json is populated and copied into the sandbox."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before starting the sandbox run, assert at least one credential source exists.\nfunction hasAnyCodexCredential(opts: { authJson: boolean; apiKey: string | undefined; sandboxSignedIn: boolean | \"unknown\" }): boolean {\n  return opts.authJson || Boolean(opts.apiKey && opts.apiKey.trim()) || opts.sandboxSignedIn === true;\n}","typeGuard":null,"tryCatchPattern":"try {\n  await ensureCodexCredentialsProvisioned(input);\n} catch (e) {\n  if (e instanceof Error && /no Codex credentials provisioned/.test(e.message)) {\n    // surface a config UI error: prompt for OPENAI_API_KEY or a signed-in image, do not retry blindly\n    return reportCredentialGap(e.message);\n  }\n  throw e;\n}","preventionTips":["Bake a valid auth.json into sandbox images used for Codex runs.","Always set a per-agent OPENAI_API_KEY as a fallback credential.","Run a sandbox auth probe during workspace setup, not at first task start, to fail fast."],"tags":["codex","credentials","sandbox","auth","configuration"],"backgroundTag":null,"analyzedSha":"67001ec6eb96ae601aa27bc91d9b2415d665334a","analyzedAt":"2026-08-12T12:05:45.408Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}