jlcodes99/cockpit-tools · error

CPA format does not support Codex Agent Identity accounts

Error message

CPA format does not support Codex Agent Identity accounts

What it means

The CPA (portable token storage) batch export throws this error when any account in the selection has an Agent Identity, because the CPA format cannot represent auth_mode='agentIdentity' credentials. The export fails fast instead of producing a lossy file.

Source

Thrown at src/utils/codexExportFormats.ts:644

  if (format === 'auth_json') {
    const payload = accounts.map(toOfficialAuthJson);
    const normalizedPayload = payload.length === 1 ? payload[0] : payload;
    return JSON.stringify(normalizedPayload, null, 2);
  }

  if (format === 'sub2api') {
    const payload: Sub2apiBatchCreatePayload = {
      exported_at: formatSub2apiExportedAt(),
      proxies: [],
      accounts: accounts.map(toSub2apiAccount),
      type: 'sub2api-data',
      version: 1,
    };
    return JSON.stringify(payload, null, 2);
  }

  if (accounts.some(hasAgentIdentity)) {
    throw new Error('CPA format does not support Codex Agent Identity accounts');
  }

  const cpaPayload = accounts.map((account) => toPortableTokenStorage(account, options));
  const normalizedPayload = cpaPayload.length === 1 ? cpaPayload[0] : cpaPayload;
  return JSON.stringify(normalizedPayload, null, 2);
}

export function buildCodexExportFileNameBase(
  baseName: string,
  format: CodexExportFormat,
): string {
  if (format === 'cockpit_tools') {
    return baseName;
  }
  if (format === 'auth_json') {
    return `${baseName}_auth`;
  }
  return `${baseName}_${format}`;

View on GitHub (pinned to 1ed8b77992)

Solutions

1. Deselect Agent Identity accounts from the CPA export batch
2. Export Agent Identity accounts via a format that supports them (e.g. sub2api agentIdentity or official auth.json)
3. Split the export: CPA for token accounts, another format for agentIdentity accounts
4. Filter with hasAgentIdentity before invoking the CPA serializer

Example fix

// before
const json = exportCpa(accounts); // throws if any hasAgentIdentity
// after
const supported = accounts.filter(a => !hasAgentIdentity(a));
const json = exportCpa(supported);

const unsupported = accounts.filter(hasAgentIdentity);
if (unsupported.length) throw new Error(`${unsupported.length} agentIdentity account(s) unsupported in CPA`);

function isCpaExportable(a: CodexAccount): boolean {
  return !hasAgentIdentity(a);
}

try {
  const json = exportCpa(accounts);
} catch (e) {
  if ((e as Error).message.includes('CPA format does not support')) {
    // split into CPA export + agentIdentity-capable export
  }
}

When it happens

Trigger: Calling the CPA export/serialize function with an accounts array where accounts.some(hasAgentIdentity) is true — mixing at least one Agent Identity account into a CPA batch export.

Common situations: Select-all export that includes agentIdentity accounts; batch migration to a tool that only supports token storage; users unaware CPA is limited to token-based accounts.

Related errors

• SUB2API_API_KEY_MISSING
• SUB2API_ACCESS_TOKEN_MISSING
• SUB2API_ACCESS_TOKEN_EXPIRY_MISSING
• Official auth.json requires OPENAI_API_KEY for API Key accou
• Official auth.json requires access_token

AI-assisted analysis of jlcodes99/cockpit-tools@1ed8b77992 (2026-09-05). Data as JSON: /api/errors/1c9be6721450983c. Report an issue: GitHub.