{"record":{"id":"c071e62657008916","repo":"openai/codex","slug":"context-source","errorCode":null,"errorMessage":"{context}: {source}","messagePattern":"\\{context\\}: \\{source\\}","errorType":"exception","errorClass":"ConfigManagerError","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server/src/config_manager_service.rs","lineNumber":52,"sourceCode":"use codex_utils_absolute_path::AbsolutePathBuf;\nuse serde_json::Value as JsonValue;\nuse std::borrow::Cow;\nuse std::path::Path;\nuse std::path::PathBuf;\nuse thiserror::Error;\nuse tokio::task;\nuse toml::Value as TomlValue;\nuse toml_edit::Item as TomlItem;\n\n#[derive(Debug, Error)]\npub(crate) enum ConfigManagerError {\n    #[error(\"{message}\")]\n    Write {\n        code: ConfigWriteErrorCode,\n        message: String,\n    },\n\n    #[error(\"{context}: {source}\")]\n    Io {\n        context: &'static str,\n        #[source]\n        source: std::io::Error,\n    },\n\n    #[error(\"{context}: {source}\")]\n    Json {\n        context: &'static str,\n        #[source]\n        source: serde_json::Error,\n    },\n\n    #[error(\"{context}: {source}\")]\n    Toml {\n        context: &'static str,\n        #[source]\n        source: toml::de::Error,","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server/src/config_manager_service.rs#L34-L70","documentation":"codex mcp-server explicitly refuses to start when workload identity auth is selected (codex_login::is_workload_identity_selected()), raising ErrorKind::Unsupported (codex-rs/mcp-server/src/lib.rs:213). Workload-identity credential chains are not implemented for the MCP server execution path, so it fails fast instead of running unauthenticated or breaking later mid-request.","triggerScenarios":"Launching `codex mcp-server` while the environment or config selects workload identity as the auth method — for example a container or CI image configured for workload-identity CLI runs reused to host the MCP server.","commonSituations":"CI images exporting workload identity settings globally; copying config.toml between machine roles; a machine configured for workload identity also trying to run the MCP server.","solutions":["Switch the MCP server's auth to a supported mode: remove the workload identity selection from config/env and use API-key or ChatGPT login auth.","Run the mcp-server under a separate CODEX_HOME / config profile without workload identity.","If workload identity is required, use an execution surface that supports it instead of codex mcp-server."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if codex_login::is_workload_identity_selected() {\n    return Err(anyhow::anyhow!(\n        \"workload identity is unsupported here; switch auth mode before starting\"\n    ));\n}","typeGuard":null,"tryCatchPattern":"match run_main(args, overrides, strict).await {\n    Err(e) if e.kind() == std::io::ErrorKind::Unsupported => {\n        // fail with guidance to switch auth mode; do not retry\n    }\n    other => other,\n}","preventionTips":["Keep separate CODEX_HOME profiles for workload-identity and MCP-server use.","Check is_workload_identity_selected() in launcher scripts before spawning the server.","Document the supported auth matrix per codex subcommand."],"tags":["auth","workload-identity","mcp-server","startup","rust"],"backgroundTag":"unsupported-auth-method","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}