Danny Kim
3565988249
Codex re-runs device login on revoked, expired, or reused sessions and token_revoked/401 errors, not only invalid_refresh_token. Claude and OpenCode credential rejections are classified too. Sign-in failures fall through to the next profile, and the failure comment names each tried profile with a fixed reason label.
1.3 KiB
1.3 KiB
description
| description |
|---|
| How codex, claude, and opencode report rejected credentials, and how the runner detects them |
Observed 2026-10 (codex 0.153/0.162, Claude Code 2.1.28x, opencode 1.18/1.19):
- Codex:
codex login statusonly reads the local auth.json, so a server-revoked ChatGPT login passes it.codex execthen exits 1 with stderr ERROR lines such asrefresh_token_invalidated/ "Your session has ended. Please log in again.",auth error code: token_revoked,401 Unauthorized; a bad API key givesinvalid_api_key. Codex echoes the whole prompt and tool output to stderr, soisCodexAuthFailureonly matches ERROR lines and the runner strips the prompt first. - Claude: a bad
CLAUDE_CODE_OAUTH_TOKENyields a stream-jsonresultwithis_error: true,api_error_status: 401, and "Failed to authenticate. API Error: 401 OAuth access token is invalid."; exit code 1, empty stderr. - OpenCode: a bad OpenRouter key exits 1 with empty stderr and a stdout JSON
event
{"type":"error","error":{"name":"APIError","data":{"statusCode":401, "message":"User not found."}}}. An empty key gives an opaque UnknownError.
Sign-in failures become AgentAuthError and fall through to the next profile
like usage exhaustion; the failure comment lists only fixed labels per profile.