{"record":{"id":"c028de5dec2a8979","repo":"jlcodes99/cockpit-tools","slug":"codex-agent-identity-credentials-are-incomplete","errorCode":null,"errorMessage":"Codex Agent Identity credentials are incomplete","messagePattern":"Codex Agent Identity credentials are incomplete","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/utils/codexExportFormats.ts","lineNumber":271,"sourceCode":"  return normalizeTimestampToIso(accessExp);\n}\n\nfunction resolveLastRefresh(account: CodexAccount): string {\n  return normalizeTimestampToIso(account.token_updated_at) || new Date().toISOString();\n}\n\nfunction hasAgentIdentity(account: CodexAccount): boolean {\n  return Boolean(account.agent_identity?.agent_runtime_id?.trim());\n}\n\nfunction buildAgentIdentityCredentials(account: CodexAccount): JsonRecord {\n  const identity = account.agent_identity;\n  const agentRuntimeId = identity?.agent_runtime_id?.trim();\n  const agentPrivateKey = identity?.agent_private_key?.trim();\n  const accountId = identity?.account_id?.trim();\n  const chatgptUserId = identity?.chatgpt_user_id?.trim();\n  if (!agentRuntimeId || !agentPrivateKey || !accountId || !chatgptUserId) {\n    throw new Error('Codex Agent Identity credentials are incomplete');\n  }\n\n  const credentials: JsonRecord = {\n    auth_mode: 'agentIdentity',\n    agent_runtime_id: agentRuntimeId,\n    agent_private_key: agentPrivateKey,\n    account_id: accountId,\n    chatgpt_account_id: accountId,\n    chatgpt_user_id: chatgptUserId,\n    chatgpt_account_is_fedramp:\n      identity?.chatgpt_account_is_fedramp === true,\n  };\n  const taskId = identity?.task_id?.trim();\n  if (taskId) {\n    credentials.task_id = taskId;\n  }\n  const email = identity?.email?.trim() || account.email?.trim();\n  if (email) {","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/jlcodes99/cockpit-tools/blob/1ed8b77992d62ca81fabf744deb0839ad361d5bf/src/utils/codexExportFormats.ts#L253-L289","documentation":"buildAgentIdentityCredentials validates that a Codex account's agent_identity carries all four required fields — agent_runtime_id, agent_private_key, account_id, chatgpt_user_id — and throws when any is missing or blank. Without them an auth_mode='agentIdentity' credential document would be invalid.","triggerScenarios":"Calling buildSub2apiCredentials, credentials, or toOfficialAuthJson on an account whose agent_identity is undefined or lacks any of the four trimmed fields.","commonSituations":"Account imported before Agent Identity fields were provisioned; partial export/import dropped identity fields; account is an OAuth/API-key account mistakenly exported in agentIdentity mode.","solutions":["Re-import or re-provision the account so agent_identity contains all four fields","Verify the account actually uses Agent Identity auth mode before exporting","Skip agentIdentity accounts in the export selection","Check for trimming/serialization data loss in the import pipeline"],"exampleFix":"// before\nconst creds = toOfficialAuthJson(account); // throws if identity incomplete\n// after\nconst id = account.agent_identity;\nif (id?.agent_runtime_id?.trim() && id?.agent_private_key?.trim() && id?.account_id?.trim() && id?.chatgpt_user_id?.trim()) {\n  const creds = toOfficialAuthJson(account);\n}","handlingStrategy":"validation","validationCode":"const id = account.agent_identity;\nconst ok = !!id?.agent_runtime_id?.trim() && !!id?.agent_private_key?.trim() &&\n  !!id?.account_id?.trim() && !!id?.chatgpt_user_id?.trim();\nif (!ok) throw new Error('agent identity incomplete');","typeGuard":"function hasCompleteAgentIdentity(a: CodexAccount): boolean {\n  const id = a.agent_identity;\n  return !!id?.agent_runtime_id?.trim() && !!id?.agent_private_key?.trim() &&\n    !!id?.account_id?.trim() && !!id?.chatgpt_user_id?.trim();\n}","tryCatchPattern":"try {\n  const creds = buildSub2apiCredentials(account);\n} catch (e) {\n  if ((e as Error).message.includes('Agent Identity credentials are incomplete')) {\n    // re-provision identity or skip account\n  }\n}","preventionTips":["Validate agent_identity completeness at import time","Only export accounts whose auth mode matches available credentials","Log which of the four fields is missing to speed diagnosis"],"tags":["validation","credentials","missing-field"],"backgroundTag":"missing-credential-field","analyzedSha":"1ed8b77992d62ca81fabf744deb0839ad361d5bf","analyzedAt":"2026-09-05T09:51:41.178Z","contentChangedAt":"2026-09-05T09:51:41.178Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}