delete the file inside the container or wipe the archon_

Error message

    delete the file inside the container or wipe the archon_user_home volume to reset.

What it means

Final line of the stale Codex auth warning: setupAuth instructs the operator to delete the persisted auth.json inside the container or wipe the archon_user_home volume to reset, then returns early, leaving the existing credentials in place. Codex remains available but on the old credential set.

Source

Thrown at packages/server/src/scripts/setup-auth.ts:44

  const accessToken = process.env.CODEX_ACCESS_TOKEN;
  const refreshToken = process.env.CODEX_REFRESH_TOKEN;
  const accountId = process.env.CODEX_ACCOUNT_ID;

  // No CODEX_* env vars provided: warn if a persisted auth.json already
  // exists on the volume (may be stale), otherwise skip with "unavailable".
  if (!idToken || !accessToken || !refreshToken || !accountId) {
    // /home/appuser is now persisted across restarts in Docker, so a stale
    // auth.json from a previous run with creds is not automatically wiped.
    // Surface this so operators don't end up with Codex silently using old/revoked tokens.
    const persistedAuthPath = path.join(os.homedir(), '.codex', 'auth.json');
    if (fs.existsSync(persistedAuthPath)) {
      console.warn(
        `⚠️  CODEX_* env vars not set, but persisted ${persistedAuthPath} exists from a previous run`
      );
      console.warn(
        '    Codex will attempt to use those credentials. If they are stale or revoked,'
      );
      console.warn(
        '    delete the file inside the container or wipe the archon_user_home volume to reset.'
      );
      return;
    }
    console.log('⏭️  Skipping Codex auth setup - credentials not provided');
    console.log('   Codex assistant will be unavailable');
    return;
  }

  console.log('🔐 Setting up Codex authentication...');

  // Create auth.json structure
  const authData: AuthJson = {
    OPENAI_API_KEY: null,
    tokens: {
      id_token: idToken,
      access_token: accessToken,
      refresh_token: refreshToken,

View on GitHub (pinned to 0773b97458)

Solutions

Run: rm ~/.codex/auth.json inside the container (or docker exec into it)
Or remove the archon_user_home volume and restart to reset the persisted home
Or provide CODEX_* env vars and re-run setup-auth to overwrite the file

Example fix

null

Defensive patterns

Strategy: validation

Validate before calling

// reset persisted Codex auth before starting without env credentials
fs.rmSync(path.join(os.homedir(), '.codex', 'auth.json'), { force: true });

Type guard

null

Try / catch

null

Prevention

Decide explicitly per deployment: either supply CODEX_* env vars or start from a clean home
Wipe archon_user_home when reusing a volume across unrelated credential sets
Log credential provenance (env vs persisted file) at startup for auditability

When it happens

Trigger: Same setupAuth path: no CODEX_* env vars provided and persisted ~/.codex/auth.json detected; the function returns after printing the three warning lines.

Common situations: Operator wants to intentionally keep existing credentials; or must clean up before Codex can authenticate with valid tokens.

Related errors

AI-assisted analysis of coleam00/Archon@0773b97458 (2026-09-01). Data as JSON: /api/errors/bcb8b6921ac19c2f. Report an issue: GitHub.