{"record":{"id":"e2df044ef7f2fe67","repo":"openai/codex","slug":"invalid-remote-control-account-id-header-err","errorCode":null,"errorMessage":"invalid remote control account id header: {err}","messagePattern":"invalid remote control account id header: (.+?)","errorType":"exception","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server-transport/src/transport/remote_control/auth.rs","lineNumber":27,"sourceCode":"use tokio::sync::watch;\nuse tracing::info;\nuse tracing::warn;\n\npub(super) const REMOTE_CONTROL_ACCOUNT_ID_HEADER: &str = \"chatgpt-account-id\";\n\npub(super) struct RemoteControlConnectionAuth {\n    pub(super) auth_provider: SharedAuthProvider,\n    pub(super) account_id: String,\n}\n\nimpl RemoteControlConnectionAuth {\n    pub(super) fn request_headers(&self) -> io::Result<HeaderMap> {\n        let mut headers = HeaderMap::new();\n        self.auth_provider.add_auth_headers(&mut headers);\n        headers.insert(\n            REMOTE_CONTROL_ACCOUNT_ID_HEADER,\n            HeaderValue::from_str(&self.account_id).map_err(|err| {\n                io::Error::new(\n                    ErrorKind::InvalidInput,\n                    format!(\"invalid remote control account id header: {err}\"),\n                )\n            })?,\n        );\n        Ok(headers)\n    }\n}\n\npub(super) async fn load_remote_control_auth(\n    auth_manager: &Arc<AuthManager>,\n) -> io::Result<RemoteControlConnectionAuth> {\n    let mut reloaded = false;\n    let auth = loop {\n        let Some(auth) = auth_manager.auth().await else {\n            if reloaded {\n                return Err(io::Error::new(\n                    ErrorKind::PermissionDenied,","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server-transport/src/transport/remote_control/auth.rs#L9-L45","documentation":"Raised while building request headers for remote-control management traffic: the stored ChatGPT account id is not a legal HTTP header value, so HeaderValue::from_str fails and request_headers wraps it in an io::Error of kind InvalidInput. The id becomes the chatgpt-account-id header on every list/revoke/pairing request, so any control character, newline, or otherwise invalid byte in the stored id breaks all remote-control calls before they are sent.","triggerScenarios":"request_headers() runs on every remote-control HTTP request (send_client_management_request_once, send_remote_control_server_request, and the pairing/enrollment flows) and fails when the account id from auth contains bytes invalid in a header value — e.g. an embedded newline as in the repo test 'invalid\\naccount', other control characters, or any value HeaderValue::from_str rejects.","commonSituations":"Hand-edited or corrupted CODEX_HOME/auth.json with a stray newline or whitespace in the account id field; account ids pasted from elsewhere; auth files mangled by provisioning scripts or line-ending conversion that introduced CRLF into the id.","solutions":["Inspect the ChatGPT account id in CODEX_HOME/auth.json for stray newlines, control characters, or invisible bytes","Re-run codex login (Sign in with ChatGPT) so the server writes a clean account id","If the id originates upstream, strip/validate it to header-safe ASCII before persisting it"],"exampleFix":"// before: auth.json\n\"chatgpt_account_id\": \"acct-123\\n\"\nlet headers = auth.request_headers()?; // Err: invalid remote control account id header\n\n// after: auth.json\n\"chatgpt_account_id\": \"acct-123\"\nlet headers = auth.request_headers()?; // Ok: sends chatgpt-account-id: acct-123","handlingStrategy":"validation","validationCode":"use axum::http::HeaderValue;\n\nfn account_id_is_header_safe(id: &str) -> bool {\n    HeaderValue::from_str(id).is_ok()\n}\n// run after loading auth, before the first remote-control request","typeGuard":null,"tryCatchPattern":"Match io::Error where kind() == InvalidInput and the message starts with 'invalid remote control account id header'; surface it as corrupt login data (offer re-login). Retrying unchanged cannot succeed — the same stored id fails every time.","preventionTips":["Never hand-edit the account id in auth.json; let codex login write it","Assert HeaderValue::from_str(id).is_ok() on stored ids in test fixtures","Fail fast on control characters when persisting account ids upstream"],"tags":["http-headers","authentication","remote-control","rust","invalid-input"],"backgroundTag":"invalid-header-value","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}