{"record":{"id":"f63875e84f8a276b","repo":"openai/codex","slug":"invalid-agent-graph-store-request-message","errorCode":null,"errorMessage":"invalid agent graph store request: {message}","messagePattern":"invalid agent graph store request: (.+?)","errorType":"error_code","errorClass":"AgentGraphStoreError","httpStatus":null,"severity":"error","filePath":"codex-rs/agent-graph-store/src/error.rs","lineNumber":8,"sourceCode":"/// Result type returned by agent graph store operations.\npub type AgentGraphStoreResult<T> = Result<T, AgentGraphStoreError>;\n\n/// Error type shared by agent graph store implementations.\n#[derive(Debug, thiserror::Error)]\npub enum AgentGraphStoreError {\n    /// The caller supplied invalid request data.\n    #[error(\"invalid agent graph store request: {message}\")]\n    InvalidRequest {\n        /// User-facing explanation of the invalid request.\n        message: String,\n    },\n\n    /// Catch-all for implementation failures that do not fit a more specific category.\n    #[error(\"agent graph store internal error: {message}\")]\n    Internal {\n        /// User-facing explanation of the implementation failure.\n        message: String,\n    },\n}\n","sourceCodeStart":1,"sourceCodeEnd":21,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/agent-graph-store/src/error.rs#L1-L21","documentation":"An inject_request_headers entry selected secret_env_var as its secret source, but the value is empty or whitespace-only. The field holds the NAME of an environment variable (for example CODEX_GITHUB_TOKEN), not the token itself; the proxy resolves that variable at request time to build the header value, so a blank name can never resolve. Raised by validate_injected_headers during config validation.","triggerScenarios":"[[network.mitm_hooks.actions.inject_request_headers]] with name = \"authorization\", secret_env_var = \"\" (or a whitespace-only string), and no secret_file — validation aborts config load.","commonSituations":"A templating placeholder that was never replaced; the field left as an empty string after migrating from secret_file; the mistaken belief that the token value itself goes into this field.","solutions":["Set secret_env_var to a real variable name and export it before the proxy starts: secret_env_var = \"CODEX_GITHUB_TOKEN\"","If the secret lives in a file instead, remove secret_env_var entirely and set secret_file to an absolute path","Keep prefix = \"Bearer \" as-is; it is prepended to the resolved secret, not part of the name"],"exampleFix":"// config.toml — before\n[[network.mitm_hooks.actions.inject_request_headers]]\nname = \"authorization\"\nsecret_env_var = \"\"\nprefix = \"Bearer \"\n\n// after\n[[network.mitm_hooks.actions.inject_request_headers]]\nname = \"authorization\"\nsecret_env_var = \"CODEX_GITHUB_TOKEN\"\nprefix = \"Bearer \"","handlingStrategy":"validation","validationCode":"for header in &hook.actions.inject_request_headers {\n    if let Some(var) = header.secret_env_var.as_deref() {\n        if var.trim().is_empty() {\n            return Err(anyhow!(\"{} has a blank secret_env_var\", header.name));\n        }\n    }\n}","typeGuard":"fn secret_env_var_valid(header: &InjectedHeaderConfig) -> bool {\n    header.secret_env_var.as_deref().map_or(true, |v| !v.trim().is_empty())\n}","tryCatchPattern":"match validate_mitm_hook_config(&config) {\n    Ok(()) => {}\n    Err(err) if err.to_string().contains(\"secret_env_var must not be empty\") => { /* fill a real variable name */ }\n    Err(err) => return Err(err),\n}","preventionTips":["Never put token values in config — the field takes a variable name","Smoke-test that each secret_env_var resolves via std::env::var before launch","Review config diffs for both secret fields on every injected header"],"tags":["rust","network-proxy","mitm-hooks","secrets","env-vars","config-validation"],"backgroundTag":"config-validation-failed","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}