{"record":{"id":"e7d0131377cd82fe","repo":"openai/codex","slug":"message-e7d013","errorCode":null,"errorMessage":"{message}","messagePattern":"\\{message\\}","errorType":"exception","errorClass":"CloudConfigBundleLoadError","httpStatus":null,"severity":"error","filePath":"codex-rs/config/src/cloud_config_bundle.rs","lineNumber":149,"sourceCode":"\n        Ok(Self {\n            enterprise_managed_config,\n            enterprise_managed_requirements,\n        })\n    }\n}\n\n#[derive(Clone, Copy, Debug, Eq, PartialEq)]\npub enum CloudConfigBundleLoadErrorCode {\n    Auth,\n    Timeout,\n    RequestFailed,\n    InvalidBundle,\n    Internal,\n}\n\n#[derive(Clone, Debug, Eq, Error, PartialEq)]\n#[error(\"{message}\")]\npub struct CloudConfigBundleLoadError {\n    code: CloudConfigBundleLoadErrorCode,\n    message: String,\n    status_code: Option<u16>,\n}\n\nimpl CloudConfigBundleLoadError {\n    pub fn new(\n        code: CloudConfigBundleLoadErrorCode,\n        status_code: Option<u16>,\n        message: impl Into<String>,\n    ) -> Self {\n        Self {\n            code,\n            message: message.into(),\n            status_code,\n        }\n    }","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/config/src/cloud_config_bundle.rs#L131-L167","documentation":"Carrier error for a failed load of the enterprise-managed cloud config bundle. The displayed text is whatever message the backing getter produced (#[error(\"{message}\")]); the actionable structure is the private code field - Auth, Timeout, RequestFailed, InvalidBundle or Internal - plus an optional HTTP status_code, exposed through .code() and .status_code(). Constructed by the future passed to CloudConfigBundleLoader and surfaced via CloudConfigBundleLoader::get().","triggerScenarios":"Calling (or awaiting the shared future of) CloudConfigBundleLoader::get() when the backend fetch fails: expired or invalid auth token (Auth, typically 401/403), request timeout, transport failure or 5xx (RequestFailed), a response that is not a valid bundle payload (InvalidBundle), or an unexpected client-side fault (Internal).","commonSituations":"Long-lived session whose SSO token expired before a config refresh; corporate proxy or egress rules blocking the config backend; a backend deploy shipping a malformed bundle; client/backend version skew.","solutions":["Branch on .code(): Auth means re-authenticate (re-run login) and retry the load","Timeout or RequestFailed means check network, proxy and egress to the config backend, then retry with backoff","InvalidBundle means compare client and backend versions, update the client, and verify the payload the backend serves","Internal means capture message and status_code and report it; retrying is unlikely to help"],"exampleFix":"// before\nlet bundle = loader.get().await?; // opaque error\n\n// after: route on the structured code\nlet bundle = match loader.get().await {\n    Ok(b) => b,\n    Err(e) if e.code() == CloudConfigBundleLoadErrorCode::Auth => relogin_and_retry().await?,\n    Err(e) if matches!(e.code(), CloudConfigBundleLoadErrorCode::Timeout | CloudConfigBundleLoadErrorCode::RequestFailed) => retry_with_backoff().await?,\n    Err(e) => return Err(e.into()),\n};","handlingStrategy":"retry","validationCode":null,"typeGuard":"pub fn as_cloud_config_bundle_load_error(\n    err: &anyhow::Error,\n) -> Option<&CloudConfigBundleLoadError> {\n    err.downcast_ref::<CloudConfigBundleLoadError>()\n}","tryCatchPattern":"match loader.get().await {\n    Ok(bundle) => { /* apply layers */ }\n    Err(e) => match e.code() {\n        CloudConfigBundleLoadErrorCode::Auth => { /* refresh credentials, retry once */ }\n        CloudConfigBundleLoadErrorCode::Timeout | CloudConfigBundleLoadErrorCode::RequestFailed => { /* backoff and retry with capped attempts */ }\n        CloudConfigBundleLoadErrorCode::InvalidBundle | CloudConfigBundleLoadErrorCode::Internal => { /* surface e.message() and status_code; do not retry */ }\n    }\n}","preventionTips":["Fall back to the last successfully applied bundle when a refresh fails","Refresh auth tokens before expiry rather than at load time","Wrap bundle fetches with a timeout and bounded retry","Log code and status_code, not just the message, for diagnosability"],"tags":["config","codex","cloud-config","enterprise-managed","http","authentication","timeout"],"backgroundTag":"config-fetch-failed","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}