{"record":{"id":"d7cc9f586b488095","repo":"usestrix/strix","slug":"not-authenticated","errorCode":"not_authenticated","errorMessage":"not_authenticated: not signed in; run: strix auth login","messagePattern":"not_authenticated: not signed in; run: strix auth login","errorType":"error_code","errorClass":"CodexAuthError","httpStatus":null,"severity":"error","filePath":"strix/config/codex.py","lineNumber":330,"sourceCode":"        org_id = organizations[0].get(\"id\")\n        if isinstance(org_id, str) and org_id:\n            return org_id\n    return None\n\n\ndef _near_expiry(record: dict[str, Any]) -> bool:\n    expires_at = record.get(\"expires_at\")\n    if not isinstance(expires_at, int | float):\n        return True\n    return expires_at - _EXPIRY_SKEW_S <= time.time()\n\n\ndef get_valid_token() -> tuple[str, str]:\n    \"\"\"Return ``(access_token, account_id)``, refreshing under the cross-process\n    guard if near expiry.\"\"\"\n    record = read_record()\n    if record is None:\n        raise CodexAuthError(\"not_authenticated\", \"not signed in; run: strix auth login\")\n    if not _near_expiry(record):\n        return record[\"access\"], record[\"account_id\"]\n    with _refresh_guard():\n        record = read_record()\n        if record is None:\n            raise CodexAuthError(\"not_authenticated\", \"not signed in; run: strix auth login\")\n        if not _near_expiry(record):\n            return record[\"access\"], record[\"account_id\"]\n        try:\n            refreshed = refresh_tokens(record[\"refresh\"])\n        except CodexAuthError:\n            # A peer process may have already spent this single-use refresh token.\n            latest = read_record()\n            if latest and latest[\"refresh\"] != record[\"refresh\"] and not _near_expiry(latest):\n                return latest[\"access\"], latest[\"account_id\"]\n            raise\n        save_record(refreshed)\n        return refreshed[\"access\"], refreshed[\"account_id\"]","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/usestrix/strix/blob/85513391305171ecc6faffe03da4a8bda5e3febb/strix/config/codex.py#L312-L348","documentation":"CodexAuthError with code `not_authenticated` raised by `get_valid_token()` when `read_record()` returns None — the auth store at ~/.strix/subscription-auth.json has no valid Codex OAuth record (missing file, non-oauth record type, or record missing access/refresh/account_id fields). The message tells the user the exact remedy: run `strix auth login`.","triggerScenarios":"Any operation that needs a Codex token (starting a scan configured for the ChatGPT/Codex provider) before authentication, after `strix auth logout`, after the auth file is deleted/corrupted, or when the selected provider is codex but login was done for a different provider.","commonSituations":"Fresh installs where the user configured STRIX_LLM for codex without logging in; auth file removed by cleanup tools or another machine's dotfiles sync; JSON corrupted (read_record's _read_store returns {} on parse failure); user logged out in one terminal and started a scan in another.","solutions":["Run `strix auth login` and complete the browser OAuth flow on localhost:1455/auth/callback","Verify state with `strix auth status` (or check that ~/.strix/subscription-auth.json exists and has type=oauth with access/refresh/account_id)","If the file is corrupted, `strix auth logout` then login again to rewrite it cleanly","If you don't intend to use ChatGPT subscription auth, switch the model config to an API-key provider (set the appropriate API key env var)"],"exampleFix":"# before\nstrix -n -t ./ --scan-mode quick   # raises not_authenticated when provider is codex\n# after\nstrix auth login\nstrix -n -t ./ --scan-mode quick","handlingStrategy":"validation","validationCode":"from strix.config.codex import is_authenticated\n\nif not is_authenticated():\n    raise SystemExit(\"Not signed in for Codex auth. Run: strix auth login\")\n# safe to proceed\naccess, account = get_valid_token()","typeGuard":null,"tryCatchPattern":"from strix.config.codex import CodexAuthError, get_valid_token\n\ntry:\n    access, account = get_valid_token()\nexcept CodexAuthError as e:\n    if e.code == \"not_authenticated\":\n        raise SystemExit(\"Run `strix auth login` and retry\") from e\n    raise","preventionTips":["Call `strix auth status` / is_authenticated() at scan start instead of discovering the error mid-run","Don't delete or move ~/.strix/subscription-auth.json with cleanup tools; exclude it from dotfiles sync","Prefer API-key provider env vars in CI where browser OAuth is impractical"],"tags":["auth","oauth","codex","onboarding","login"],"backgroundTag":null,"analyzedSha":"85513391305171ecc6faffe03da4a8bda5e3febb","analyzedAt":"2026-08-15T05:03:57.275Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}