openai/codex · error · AgentGraphStoreError

agent graph store internal error: {message}

Error message

agent graph store internal error: {message}

What it means

Each inject_request_headers entry must declare exactly one secret source. The match on (secret_env_var, secret_file) accepts (Some, None) and (None, Some); the wildcard arm rejects both (Some, Some) and (None, None). Both fields are Options defaulting to None via serde, so the most common cause is simply omitting both fields from the header entry.

Source

Thrown at codex-rs/agent-graph-store/src/error.rs:15

/// Result type returned by agent graph store operations.
pub type AgentGraphStoreResult<T> = Result<T, AgentGraphStoreError>;

/// Error type shared by agent graph store implementations.
#[derive(Debug, thiserror::Error)]
pub enum AgentGraphStoreError {
    /// The caller supplied invalid request data.
    #[error("invalid agent graph store request: {message}")]
    InvalidRequest {
        /// User-facing explanation of the invalid request.
        message: String,
    },

    /// Catch-all for implementation failures that do not fit a more specific category.
    #[error("agent graph store internal error: {message}")]
    Internal {
        /// User-facing explanation of the implementation failure.
        message: String,
    },
}

View on GitHub (pinned to 339751715c)

Solutions

1. Set exactly one of secret_env_var or secret_file on the entry
2. If switching sources, delete the other key rather than leaving both
3. Prefer secret_env_var for CI/deployments where secrets come from the environment, secret_file for machine-local secrets

Example fix

// config.toml — before
[[network.mitm_hooks.actions.inject_request_headers]]
name = "authorization"
prefix = "Bearer "

// after
[[network.mitm_hooks.actions.inject_request_headers]]
name = "authorization"
secret_env_var = "CODEX_GITHUB_TOKEN"
prefix = "Bearer "

for header in &hook.actions.inject_request_headers {
    match (header.secret_env_var.as_deref(), header.secret_file.as_deref()) {
        (Some(_), None) | (None, Some(_)) => {}
        _ => return Err(anyhow!("{} needs exactly one of secret_env_var or secret_file", header.name)),
    }
}

fn secret_source_unique(header: &InjectedHeaderConfig) -> bool {
    matches!(
        (header.secret_env_var.as_deref(), header.secret_file.as_deref()),
        (Some(_), None) | (None, Some(_))
    )
}

When it happens

Trigger: inject_request_headers = [{ name = "authorization", prefix = "Bearer " }] with neither secret field set, or an entry that sets both secret_env_var and secret_file at once — for example while switching from env-var to file-based secrets without deleting the old key.

Common situations: Forgetting the secret source entirely when adding a hook; setting both during a migration; config merging tools that concatenate fields from two variants of an entry.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• invalid agent graph store request: {message}
• invalid agent identity JWT format
• Unsupported platform: ${platform} (${arch})
• Unsupported target triple: ${targetTriple}
• Missing optional dependency ${platformPackage}. Reinstall Co

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/aa4694dc8b03848a. Report an issue: GitHub.