{"record":{"id":"e72e5954b15dcc78","repo":"openai/codex","slug":"ws-token-file-and-ws-token-sha256-are-mutu","errorCode":null,"errorMessage":"`--ws-token-file` and `--ws-token-sha256` are mutually exclusive","messagePattern":"`--ws-token-file` and `--ws-token-sha256` are mutually exclusive","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/app-server-transport/src/transport/auth.rs","lineNumber":159,"sourceCode":"                let trimmed = value.trim();\n                (!trimmed.is_empty()).then(|| trimmed.to_string())\n            })\n        };\n\n        let config = match self.ws_auth {\n            Some(WebsocketAuthCliMode::CapabilityToken) => {\n                if self.ws_shared_secret_file.is_some()\n                    || self.ws_issuer.is_some()\n                    || self.ws_audience.is_some()\n                    || self.ws_max_clock_skew_seconds.is_some()\n                {\n                    anyhow::bail!(\n                        \"`--ws-shared-secret-file`, `--ws-issuer`, `--ws-audience`, and `--ws-max-clock-skew-seconds` require `--ws-auth signed-bearer-token`\"\n                    );\n                }\n                let source = match (self.ws_token_file, self.ws_token_sha256) {\n                    (Some(_), Some(_)) => {\n                        anyhow::bail!(\n                            \"`--ws-token-file` and `--ws-token-sha256` are mutually exclusive\"\n                        );\n                    }\n                    (Some(token_file), None) => {\n                        AppServerWebsocketCapabilityTokenSource::TokenFile {\n                            token_file: absolute_path_arg(\"--ws-token-file\", token_file)?,\n                        }\n                    }\n                    (None, Some(token_sha256)) => {\n                        AppServerWebsocketCapabilityTokenSource::TokenSha256 {\n                            token_sha256: sha256_digest_arg(\"--ws-token-sha256\", &token_sha256)?,\n                        }\n                    }\n                    (None, None) => {\n                        anyhow::bail!(\n                            \"`--ws-token-file` or `--ws-token-sha256` is required when `--ws-auth capability-token` is set\"\n                        );\n                    }","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/app-server-transport/src/transport/auth.rs#L141-L177","documentation":"Error \"`--ws-token-file` and `--ws-token-sha256` are mutually exclusive\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/app-server-transport/src/transport/auth.rs:159 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}