{"record":{"id":"b59d153191f4aefd","repo":"warpdotdev/warp","slug":"codex-auth-secret-is-only-valid-with-harness-c","errorCode":null,"errorMessage":"--codex-auth-secret is only valid with --harness codex.","messagePattern":"--codex-auth-secret is only valid with --harness codex\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/src/ai/agent_sdk/mod.rs","lineNumber":327,"sourceCode":"\n            Ok(())\n        }\n        AgentCommand::RunCloud(args) => {\n            if args.environment.environment.is_some()\n                && !FeatureFlag::CloudEnvironments.is_enabled()\n            {\n                return Err(anyhow::anyhow!(\"unexpected argument '--environment' found\"));\n            }\n            if args.conversation.is_some() && !FeatureFlag::CloudConversations.is_enabled() {\n                return Err(anyhow::anyhow!(\n                    \"unexpected argument '--conversation' found\"\n                ));\n            }\n            if args.harness != Harness::Oz && !FeatureFlag::AgentHarness.is_enabled() {\n                return Err(anyhow::anyhow!(\"unexpected argument '--harness' found\"));\n            }\n            if let Err(msg) = args.validate_auth_secrets() {\n                return Err(anyhow::anyhow!(msg));\n            }\n            if args.runner.is_some() && !FeatureFlag::CloudRunners.is_enabled() {\n                return Err(anyhow::anyhow!(\"unexpected argument '--runner' found\"));\n            }\n            ambient::run_ambient_agent(ctx, args)\n        }\n        AgentCommand::Profile(sub) => profiles::run(ctx, global_options, sub),\n        AgentCommand::List(args) => {\n            agent_management::list_agents(ctx, global_options.output_format, args)\n        }\n        AgentCommand::Get(args) => {\n            agent_management::get_agent(ctx, global_options.output_format, args)\n        }\n        AgentCommand::Create(args) => {\n            agent_management::create_agent(ctx, global_options.output_format, args)\n        }\n        AgentCommand::Update(args) => {\n            agent_management::update_agent(ctx, global_options.output_format, args)","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/agent_sdk/mod.rs#L309-L345","documentation":"Produced by RunCloudArgs::validate_auth_secrets (crates/warp_cli/src/agent.rs:678, surfaced at mod.rs:327): `--codex-auth-secret <NAME>` names a Warp-managed secret injected server-side into a codex-harness cloud agent, and is only valid with `--harness codex`. Since `--harness` defaults to Harness::Oz, passing the secret without switching the harness fails fast with this message.","triggerScenarios":"Running `agent run-cloud --codex-auth-secret NAME ...` with any harness other than exactly `codex` (the oz default included). Pure argument-pairing check; fires before auth-secrets validation of the runner launch.","commonSituations":"Migrating a claude-harness invocation to codex and changing only the secret flag; scripts templating one secret flag for all harnesses; forgetting that the harness default is oz.","solutions":["Add `--harness codex` to the same invocation","If you meant claude, use `--harness claude --claude-auth-secret` instead","Create the secret first if needed: `oz secret create codex api-key <NAME>`"],"exampleFix":"# before\n$ oz agent run-cloud --codex-auth-secret my-key \"task\"\nError: --codex-auth-secret is only valid with --harness codex.\n\n# after\n$ oz agent run-cloud --harness codex --codex-auth-secret my-key \"task\"","handlingStrategy":"validation","validationCode":"let ok = args.codex_auth_secret.is_none() || args.harness == Harness::Codex;\nanyhow::ensure!(ok, \"--codex-auth-secret requires --harness codex\");","typeGuard":"pub fn codex_secret_ok(args: &RunCloudArgs) -> bool {\n    args.codex_auth_secret.is_none() || args.harness == Harness::Codex\n}","tryCatchPattern":"match run_agent(ctx, opts, cmd) {\n    Err(e) if e.to_string().starts_with(\"--codex-auth-secret\") => {\n        // re-invoke with --harness codex added\n    }\n    result => result?,\n}","preventionTips":["Never template a secret flag without its matching --harness value","When switching harnesses, switch both the harness flag and the secret flag in one edit","Run validate_auth_secrets() in unit tests over your invocation builder"],"tags":["cli","argument-validation","secrets","agent-harness","rust"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}