coleam00/Archon · warning

⚠️ CODEX_* env vars not set, but persisted ${persistedAuthP

Error message

⚠️  CODEX_* env vars not set, but persisted ${persistedAuthPath} exists from a previous run

What it means

setupAuth found no CODEX_* credentials in the environment, but a persisted ~/.codex/auth.json from a previous run still exists (the Docker home directory survives restarts). Because Codex will silently reuse those possibly stale or revoked tokens, the script warns the operator instead of skipping quietly.

Source

Thrown at packages/server/src/scripts/setup-auth.ts:38

  last_refresh: string;
}

function setupAuth(): void {
  // Get environment variables
  const idToken = process.env.CODEX_ID_TOKEN;
  const accessToken = process.env.CODEX_ACCESS_TOKEN;
  const refreshToken = process.env.CODEX_REFRESH_TOKEN;
  const accountId = process.env.CODEX_ACCOUNT_ID;

  // No CODEX_* env vars provided: warn if a persisted auth.json already
  // exists on the volume (may be stale), otherwise skip with "unavailable".
  if (!idToken || !accessToken || !refreshToken || !accountId) {
    // /home/appuser is now persisted across restarts in Docker, so a stale
    // auth.json from a previous run with creds is not automatically wiped.
    // Surface this so operators don't end up with Codex silently using old/revoked tokens.
    const persistedAuthPath = path.join(os.homedir(), '.codex', 'auth.json');
    if (fs.existsSync(persistedAuthPath)) {
      console.warn(
        `⚠️  CODEX_* env vars not set, but persisted ${persistedAuthPath} exists from a previous run`
      );
      console.warn(
        '    Codex will attempt to use those credentials. If they are stale or revoked,'
      );
      console.warn(
        '    delete the file inside the container or wipe the archon_user_home volume to reset.'
      );
      return;
    }
    console.log('⏭️  Skipping Codex auth setup - credentials not provided');
    console.log('   Codex assistant will be unavailable');
    return;
  }

  console.log('🔐 Setting up Codex authentication...');

  // Create auth.json structure

View on GitHub (pinned to 0773b97458)

Solutions

1. Set the CODEX_* env vars so fresh credentials are written over the persisted auth.json
2. Delete the stale file: remove ~/.codex/auth.json inside the container
3. Wipe the archon_user_home volume to reset the persisted home
4. Verify the persisted credentials still work if you intend to keep using them

Example fix

null

import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
const stale = !process.env.CODEX_ACCESS_TOKEN && fs.existsSync(path.join(os.homedir(), '.codex', 'auth.json'));

function hasFreshCodexEnv(env: NodeJS.ProcessEnv = process.env): boolean {
  return Boolean(env.CODEX_ID_TOKEN && env.CODEX_ACCESS_TOKEN && env.CODEX_REFRESH_TOKEN && env.CODEX_ACCOUNT_ID);
}

null

When it happens

Trigger: Running the setup-auth script with idToken/accessToken/refreshToken/accountId all unset while fs.existsSync(os.homedir()/.codex/auth.json) is true from an earlier run.

Common situations: Container restart where CODEX_* env vars were removed from the deployment config; rotating credentials but forgetting the persisted volume; shared archon_user_home volume reused across deployments.

Related errors

• Codex will attempt to use those credentials. If they are
• delete the file inside the container or wipe the archon_
• OpenAI token ${operation} response did not include an id_tok
• Repository ${owner}/${repo} not found or is private. Check r
• Authentication failed for ${owner}/${repo}. Check GITEA_TOKE

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/1a017c166bb8f57c. Report an issue: GitHub.