{"record":{"id":"bdd48d0f501147e1","repo":"can1357/oh-my-pi","slug":"codex-security-cloud-authentication-refresh-failed","errorCode":null,"errorMessage":"Codex Security cloud authentication refresh failed","messagePattern":"Codex Security cloud authentication refresh failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/cloud.ts","lineNumber":226,"sourceCode":"\t\t\tconst body = typeof options.body === \"function\" ? options.body(access.accessToken) : options.body;\n\t\t\tconst headers: Record<string, string> = {\n\t\t\t\tAccept: \"application/json\",\n\t\t\t\tAuthorization: `Bearer ${access.accessToken}`,\n\t\t\t};\n\t\t\tconst accountId = access.accountId ?? this.#account.accountId;\n\t\t\tif (accountId) headers[\"ChatGPT-Account-Id\"] = accountId;\n\t\t\tif (body) headers[\"Content-Type\"] = \"application/json\";\n\t\t\tconst response = await this.#fetch(url, {\n\t\t\t\tmethod: options.method ?? \"GET\",\n\t\t\t\theaders,\n\t\t\t\tbody: body ? JSON.stringify(body) : undefined,\n\t\t\t\tsignal: options.signal,\n\t\t\t});\n\t\t\tif (response.status === 401 && attempt === 0) continue;\n\t\t\tif (!response.ok) throw new CodexSecurityCloudHttpError(response.status, url.pathname);\n\t\t\treturn object(await response.json());\n\t\t}\n\t\tthrow new Error(\"Codex Security cloud authentication refresh failed\");\n\t}\n\n\tasync listConfigurations(\n\t\toptions: { limit?: number; cursor?: string; signal?: AbortSignal } = {},\n\t): Promise<CodexSecurityCloudConfigurationPage> {\n\t\tconst raw = await this.#request(\"scan_configurations\", {\n\t\t\tquery: { limit: options.limit ?? 100, cursor: options.cursor },\n\t\t\tsignal: options.signal,\n\t\t});\n\t\tconst items = Array.isArray(raw.items) ? raw.items.map(normalizeConfiguration) : [];\n\t\tconst result: CodexSecurityCloudConfigurationPage = { items };\n\t\tconst nextCursor = optionalString(raw.next_cursor);\n\t\tif (nextCursor) result.nextCursor = nextCursor;\n\t\tif (typeof raw.total_in_account === \"number\") result.totalInAccount = raw.total_in_account;\n\t\treturn result;\n\t}\n\tasync listAllConfigurations(signal?: AbortSignal): Promise<CodexSecurityCloudConfiguration[]> {\n\t\tconst configurations: CodexSecurityCloudConfiguration[] = [];","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/cloud.ts#L208-L244","documentation":"#request retries once on HTTP 401 (attempt 0) hoping the access token refreshes; if the second attempt also returns 401, the loop exits and this error is thrown. It means cloud authentication could not be established even after a forced refresh.","triggerScenarios":"Two consecutive 401 responses from the Codex Security cloud API: expired/revoked refresh token, revoked ChatGPT session, or a server-side auth rejection that survives token refresh.","commonSituations":"ChatGPT session revoked (password change, device sign-out); long-lived credential whose refresh token expired; cloud-side auth backend incident.","solutions":["Re-authenticate the openai-codex credential (fresh login) and retry","Delete and re-add the stored OAuth credential","Check provider status / cloud incidents if refresh succeeds but API still 401s","Verify system clock correctness (skew breaks token validation)"],"exampleFix":"// before\nawait client.listConfigurations(); // throws after double 401\n// after\ntry {\n  await client.listConfigurations();\n} catch {\n  await reauthenticateChatGPT(authStorage); // fresh tokens\n  await client.listConfigurations();\n}","handlingStrategy":"retry","validationCode":"const accounts = authStorage.listOAuthAccounts(\"openai-codex\");\nif (accounts.length === 0) throw new Error(\"No openai-codex credential; authenticate first\");","typeGuard":null,"tryCatchPattern":"try {\n  return await client.listFindingDetails(id);\n} catch (err) {\n  if (err.message === \"Codex Security cloud authentication refresh failed\") {\n    await reauthenticate(\"openai-codex\"); // one re-auth, then single retry\n    return await client.listFindingDetails(id);\n  }\n  throw err;\n}","preventionTips":["Refresh credentials proactively before scans","Surface re-auth prompts instead of failing silently","Check ChatGPT session status when repeated 401s occur"],"tags":["authentication","http-401","token-refresh"],"backgroundTag":"auth-refresh-failed","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}