{"record":{"id":"f7e62d786ee524fd","repo":"router-for-me/CLIProxyAPI","slug":"invalid-realtime-client-secret","errorCode":"invalid_realtime_client_secret","errorMessage":"Realtime client secret is invalid or expired","messagePattern":"Realtime client secret is invalid or expired","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"internal/client/codex/live/client_secret.go","lineNumber":31,"sourceCode":"\t\"time\"\n\n\t\"github.com/gin-gonic/gin\"\n)\n\nconst (\n\tClientSecretSessionContextKey   = \"codexLiveClientSecretSession\"\n\tClientSecretPrincipalContextKey = \"codexLiveClientSecretPrincipal\"\n\tclientSecretPrefix              = \"ek_\"\n\tclientSecretDefaultLifetime     = 10 * time.Minute\n\tclientSecretMinimumLifetime     = 10 * time.Second\n\tclientSecretMaximumLifetime     = 2 * time.Hour\n\tclientSecretMaxBodySize         = 64 << 10\n\tclientSecretMaxEntries          = 1024\n\tclientSecretMaxEntriesPerIssuer = 64\n)\n\nvar (\n\terrInvalidClientSecret    = errors.New(\"Realtime client secret is invalid or expired\")\n\terrClientSecretCapacity   = errors.New(\"Realtime client secret capacity exhausted\")\n\terrUnsupportedSessionType = errors.New(\"Realtime session type is not supported\")\n)\n\n// ClientSecretAuthorization contains the local session configuration associated with an ephemeral key.\ntype ClientSecretAuthorization struct {\n\tPrincipal       string\n\tIssuerPrincipal string\n\tIssuerProvider  string\n\tSession         json.RawMessage\n}\n\ntype clientSecretEntry struct {\n\tauthorization ClientSecretAuthorization\n\texpiresAt     time.Time\n}\n\ntype clientSecretStore struct {","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/client/codex/live/client_secret.go#L13-L49","documentation":"Returned when the model stream bridge cannot hand out a stream ID: either h.modelStreams is nil (bridge never created) or open() failed. The bridge maps StreamIDs to chunk channels plus cancel funcs so the plugin can read the model stream incrementally; without an ID the just-started upstream stream is cancelled and the callback aborts.","triggerScenarios":"Host constructed without the model stream bridge (partial initialization, some test harnesses), or open() returning \"\" because the bridge is closed/shut down while a plugin initiates host.model.execute_stream.","commonSituations":"Embedding the SDK but constructing the plugin Host manually without the full builder; host shutdown racing a plugin's model call; a fork of the host code that skips bridge creation.","solutions":["Construct the Host through the SDK builder/entrypoint (sdk/cliproxy) so all bridges, including modelStreams, are initialized.","If building a Host manually, initialize the model stream bridge field before loading plugins.","Avoid issuing host.model.execute_stream during host shutdown; gate plugin callbacks on a readiness flag."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"resp, err := host.Call(ctx, \"host.model.execute_stream\", raw)\nif err != nil {\n    if strings.Contains(err.Error(), \"stream bridge is unavailable\") {\n        return errors.New(\"host misconfigured: model stream bridge not initialized\")\n    }\n    return err\n}","preventionTips":["Construct the Host through the SDK builder so all bridges exist.","Never call model-stream RPCs during host shutdown.","Fail fast on host construction errors instead of running a partially wired host."],"tags":["pluginhost","streaming","initialization"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}