{"record":{"id":"9991f618eb452361","repo":"stablyai/orca","slug":"codex-auth-json-is-corrupt-or-not-valid-json","errorCode":null,"errorMessage":"Codex auth.json is corrupt or not valid JSON","messagePattern":"Codex auth\\.json is corrupt or not valid JSON","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/codex-accounts/service.ts","lineNumber":1843,"sourceCode":"  }\n\n  private loadOAuthCredentials(\n    managedHomePath: string,\n    expectedAccountId: string\n  ): CodexOAuthCredentials {\n    const authFilePath = join(\n      this.assertManagedHomePath(managedHomePath, expectedAccountId),\n      'auth.json'\n    )\n    const authFileContents = readFileSync(authFilePath, 'utf-8')\n    let parsed: Record<string, unknown>\n    try {\n      parsed = JSON.parse(authFileContents) as Record<string, unknown>\n    } catch {\n      // Why: a raw SyntaxError echoes credential bytes into logs/error UI; a\n      // corrupt auth.json must fail loudly but without them (same sanitization\n      // intent as the system-default identity path, which degrades instead).\n      throw new Error('Codex auth.json is corrupt or not valid JSON')\n    }\n    return this.extractOAuthCredentials(parsed)\n  }\n\n  private extractOAuthCredentials(raw: Record<string, unknown>): CodexOAuthCredentials {\n    // Why: API-key-based auth files have no OAuth tokens or JWT identity\n    // claims. Returning nulls causes the caller to fail with a clear\n    // \"could not resolve the account email\" error rather than crashing\n    // on missing nested token fields.\n    if (typeof raw.OPENAI_API_KEY === 'string' && raw.OPENAI_API_KEY.trim() !== '') {\n      return {\n        idToken: null,\n        accountId: null\n      }\n    }\n\n    const tokens = this.readRecordClaim(raw, 'tokens')\n    return {","sourceCodeStart":1825,"sourceCodeEnd":1861,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/codex-accounts/service.ts#L1825-L1861","documentation":"Thrown by loadOAuthCredentials when auth.json inside a managed home fails JSON.parse. The raw SyntaxError is deliberately swallowed and replaced with this generic message so malformed credential bytes are never echoed into logs or error UI. The file is still expected to be Orca-owned (assertManagedHomePath runs first).","triggerScenarios":"loadOAuthCredentials(managedHomePath, expectedAccountId) where readFileSync(<home>/auth.json) succeeds but JSON.parse(contents) throws — truncated file, BOM/garbage, hand-edited invalid JSON, or another process mid-write.","commonSituations":"Concurrent write to auth.json truncated it; a text editor saved it with invalid syntax; a sync/backup tool delivered a partial file; encoding conversion corrupted it; a previous login was interrupted mid-write.","solutions":["Re-run the Codex login flow for the account so auth.json is regenerated cleanly.","If you have a known-good backup of auth.json, restore it (preserving the Orca-owned home/marker) and retry.","Ensure no other process (editor, sync agent) writes to the managed home concurrently during login."],"exampleFix":"// before: auth.json is corrupt -> login identity load fails\nawait svc.readIdentityFromHome(homePath, acctId) // throws 'Codex auth.json is corrupt or not valid JSON'\n\n// after: re-login to regenerate auth.json\nawait svc.runCodexLogin(account, credentials)","handlingStrategy":"try-catch","validationCode":"import { readFileSync } from 'node:fs'\n\nfunction isAuthJsonParsable(homePath: string): boolean {\n  try {\n    JSON.parse(readFileSync(`${homePath}/auth.json`, 'utf-8'))\n    return true\n  } catch {\n    return false\n  }\n}\n\nif (!isAuthJsonParsable(homePath)) {\n  // re-run codex login to regenerate auth.json\n}","typeGuard":"function isCorruptAuthJsonError(error: unknown): boolean {\n  return error instanceof Error && error.message === 'Codex auth.json is corrupt or not valid JSON'\n}","tryCatchPattern":"try {\n  await svc.readIdentityFromHome(homePath, acctId)\n} catch (error) {\n  if (isCorruptAuthJsonError(error)) {\n    // credentials are unrecoverable from this file; re-login\n    await svc.runCodexLogin(account, credentials)\n  } else {\n    throw error\n  }\n}","preventionTips":["Do not open or edit auth.json in a text editor; treat it as binary.","Ensure login writes are atomic and no other process writes the file concurrently.","Use backup tools that deliver complete files, not partial deltas."],"tags":["codex-accounts","json","credentials","integrity","sanitization"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}