{"record":{"id":"e1343beaaa6bd1bd","repo":"openai/codex","slug":"failed-to-parse-cloud-config-fragment-fragment","errorCode":null,"errorMessage":"failed to parse cloud config fragment {fragment}: {message}","messagePattern":"failed to parse cloud config fragment (.+?): (.+?)","errorType":"validation","errorClass":"CloudConfigLayerError","httpStatus":null,"severity":"error","filePath":"codex-rs/config/src/cloud_config_layers.rs","lineNumber":56,"sourceCode":"        }\n    }\n}\n\n#[derive(Clone, Debug, PartialEq, Eq)]\npub struct CloudConfigFragmentSource {\n    pub id: String,\n    pub name: String,\n}\n\nimpl fmt::Display for CloudConfigFragmentSource {\n    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n        write!(f, \"{} ({})\", self.name, self.id)\n    }\n}\n\n#[derive(Debug, Error, PartialEq, Eq)]\npub enum CloudConfigLayerError {\n    #[error(\"failed to parse cloud config fragment {fragment}: {message}\")]\n    Parse {\n        fragment: CloudConfigFragmentSource,\n        message: String,\n    },\n    #[error(\"invalid cloud config fragment {fragment}: {message}\")]\n    Invalid {\n        fragment: CloudConfigFragmentSource,\n        message: String,\n    },\n}\n\npub fn cloud_config_layers_from_fragments(\n    fragments: impl IntoIterator<Item = CloudConfigFragment>,\n    base_dir: &AbsolutePathBuf,\n) -> Result<Vec<ConfigLayerEntry>, CloudConfigLayerError> {\n    cloud_config_layers_from_fragments_impl(fragments, base_dir, /*strict_config*/ false)\n}\n","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/config/src/cloud_config_layers.rs#L38-L74","documentation":"Every enterprise-managed fragment in a cloud config bundle is parsed with toml::from_str inside cloud_config_layers_from_fragments (reached via CloudConfigBundleLayers::from_bundle). When a fragment's contents are not valid TOML, this Parse variant is returned carrying the fragment's name and id plus the underlying toml error, so the offending fragment can be identified precisely.","triggerScenarios":"CloudConfigBundleLayers::from_bundle (or cloud_config_layers_from_fragments) receiving a fragment whose contents have a TOML syntax error: unbalanced brackets or quotes, duplicate keys, invalid escapes, or a construct the parser cannot accept.","commonSituations":"An admin edits the enterprise fragment in the management console and introduces a typo; a backend template bug emits malformed TOML; version skew where the fragment uses syntax the client's toml parser rejects.","solutions":["Copy the fragment's contents out and validate locally - python3 -c 'import tomllib,sys; tomllib.load(open(sys.argv[1],\"rb\"))' fragment.toml - to see the exact syntax error","Fix the TOML in the admin console or repo that publishes the fragment and let the bundle refresh","Update the Codex client if the backend legitimately emits newer TOML than the installed parser accepts","As a stopgap, remove the offending fragment (matched by the id in the error message) from the bundle so the remaining layers still apply"],"exampleFix":"# before: fragment 'policy-main' contents\napproval_policy = \"never\n\n# after\napproval_policy = \"never\"","handlingStrategy":"validation","validationCode":"// Publish-side check: reject fragments that will fail client-side parse\nfn fragment_parses(contents: &str) -> bool {\n    toml::from_str::<toml::Value>(contents).is_ok()\n}","typeGuard":"pub fn is_cloud_config_parse_error(err: &anyhow::Error) -> bool {\n    matches!(\n        err.downcast_ref::<CloudConfigLayerError>(),\n        Some(CloudConfigLayerError::Parse { .. })\n    )\n}","tryCatchPattern":"match CloudConfigBundleLayers::from_bundle(bundle, &base_dir) {\n    Ok(layers) => { /* push layers */ }\n    Err(CloudConfigLayerError::Parse { fragment, message }) => {\n        // report fragment.name / fragment.id with the TOML error; keep last-good config\n    }\n    Err(other) => return Err(other.into()),\n}","preventionTips":["Lint every fragment with a TOML parser in the publishing pipeline before it ships","Run strict-config validation on bundle previews","Keep a last-known-good set of layers to fall back to when a refresh fails to parse","Include the fragment id in error dashboards to spot backend regressions quickly"],"tags":["config","codex","toml","parse-error","enterprise-managed","cloud-config"],"backgroundTag":"toml-parse-error","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}