openai/codex · error · LunaSamplerError

could not resolve the Luna model provider: {0}

Error message

could not resolve the Luna model provider: {0}

What it means

LunaSampler::open_connection resolves the thread's model provider (api_provider) and scoped credentials (api_auth_for_scope) before dialing the Responses WebSocket; either failing wraps the CodexErr as Provider. Guardian-v2's classifier model has no usable provider/auth for this thread. The sampler classifies it non-retryable, so it will not recover on its own.

Source

Thrown at codex-rs/ext/guardian-v2/src/async_scorer/sampler.rs:110

    /// Optional bounded screenshots accompanying the transcript.
    pub images: Vec<ContentItem>,
    /// Opaque parent compaction to reuse only for compatible model configurations.
    pub parent_compaction: Option<ResponseItem>,
    /// Current parent model's encrypted-compaction compatibility hash.
    pub parent_compaction_hash: Option<String>,
    /// Strict JSON schema constraining the model response.
    pub output_schema: Value,
    /// Reasoning budget explicitly selected for this request.
    pub reasoning_effort: ReasoningEffort,
    /// Owning turn identifier used for request attribution.
    pub turn_id: String,
}

/// Failures returned while connecting or sampling the Luna model.
#[derive(Debug, Error)]
pub enum LunaSamplerError {
    /// The thread's provider or scoped credentials could not be resolved.
    #[error("could not resolve the Luna model provider: {0}")]
    Provider(#[source] CodexErr),
    /// The Responses WebSocket could not be opened or streamed.
    #[error("Luna Responses WebSocket failed: {0}")]
    Api(#[source] ApiError),
    /// The provider's WebSocket connect deadline elapsed.
    #[error("Luna Responses WebSocket connection timed out")]
    ConnectionTimeout,
    /// The response did not contain an assistant text value.
    #[error("Luna response did not contain assistant output")]
    MissingOutput,
    /// The response exceeded the bounded output limit.
    #[error("Luna response exceeded the output limit")]
    OutputTooLarge,
    /// A newer classification replaced this request when the pool was full.
    #[error("Luna request was superseded by a newer classification")]
    Superseded,
}

View on GitHub (pinned to 339751715c)

Solutions

1. Inspect the nested CodexErr source — it names the exact provider/auth failure.
2. Re-authenticate (login flow) or export the provider's env_key API key.
3. Verify the model_providers entry resolves base_url, env_key, and wire_api correctly for the thread.
4. For agent-identity setups, confirm the session source permits AgentIdentitySessionFallback or provision credentials.

// Before constructing the sampler, fail fast when credentials cannot resolve
if sampler_config.provider.auth().await.is_none() {
    return Err(anyhow::anyhow!("no auth for the Luna provider; log in or set the provider env key"));
}

match result {
    Err(LunaSamplerError::Provider(codex_err)) => {
        tracing::error!(error = %codex_err, "guardian classifier disabled: provider/auth unresolvable");
        Classification::none()
    }
    r => r?,
}

When it happens

Trigger: Starting LunaSampler::connect or leasing a connection when auth is missing/expired, the provider's env_key API key variable is unset, the model_provider entry is invalid, or agent-identity auth cannot be scoped for the session source.

Common situations: CI or container runs without credentials; login tokens expired; provider config renamed the env var; agent-identity policy selected for a session source with no fallback.

Related errors

• current-time request timed out after {}s
• Luna Responses WebSocket failed: {0}
• Luna response did not contain assistant output
• Luna response exceeded the output limit
• {context}: {source}

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/639c8f781dad7b05. Report an issue: GitHub.