- Confirm plugin is installed in resolved
<config-root>/opencode.json($XDG_CONFIG_HOME/opencodewhen set, otherwise~/.config/opencode). - Confirm config exists at the resolved path (
OPENCODE_OPENAI_MULTI_CONFIG_PATHwhen set, otherwise the canonical default path$XDG_CONFIG_HOME/opencode/codex-config.jsoncwhenXDG_CONFIG_HOMEis set, else~/.config/opencode/codex-config.jsonc; commented legacycodex-config.jsonis still accepted as a fallback). - Confirm auth files exist:
- required runtime store: resolved
<config-root>/codex-accounts.json - optional legacy transfer source: resolved
<config-root>/openai-codex-accounts.json - optional legacy transfer source:
${XDG_DATA_HOME:-~/.local/share}/opencode/auth.json
- required runtime store: resolved
- Confirm cache files exist when relevant features were used (files are created on demand):
<config-root>/cache/codex-client-version.json<config-root>/cache/codex-models-cache-meta.json<config-root>/cache/codex-models-cache.json<config-root>/cache/codex-models-cache-<hash>.json<config-root>/cache/codex-auth-models-<hash>.json<config-root>/cache/codex-session-affinity.json<config-root>/cache/codex-snapshots.json
- Ensure port
1455is free. - Close other auth flows (Codex/OpenCode) and retry.
- Re-run
opencode auth login. - Verify both auth files above exist and are readable.
- Confirm your selected model slug exists in provider model list.
codex-models-cache.jsonis the shared GitHub snapshot, refreshed by comparing cachedcodex-models-cache-meta.jsontag against the target client version fromcodex-client-version.json.- Account shard files (
codex-auth-models-*.json,codex-models-cache-<hash>.json) are server catalogs and can differ from shared GitHub cache. - If shared cache is stuck, remove
codex-models-cache.jsonandcodex-models-cache-meta.json, then rerun a model-catalog path (for exampleopencode auth loginfollowed by a normal model request) to force repopulation.
- Re-run installer:
npx -y @iam-brain/opencode-codex-auth@latest - Verify file exists:
<config-root>/commands/create-personality.md - Restart OpenCode so command discovery refreshes.
- Re-run installer:
npx -y @iam-brain/opencode-codex-auth@latest - Verify file exists:
<config-root>/skills/personality-builder/SKILL.md
Usually means either:
- account expired and needs re-auth, or
- backend did not return reset timestamp for that window.
Fix:
- open account manager
- run per-account
Refresh token - run
Check quotasagain
Meaning:
- request exhausted healthy candidates and at least one account requires re-auth.
Fix:
- reauthenticate affected accounts via
opencode auth login - disable repeatedly failing accounts temporarily
Meaning:
- an account record is present but does not include identity metadata (
identityKey), so some features (like quota snapshots keyed by identity) cannot attach.
Fix:
- reauthenticate via
opencode auth loginto refresh identity fields
Expected behavior:
- existing
codex-accounts.json(including emptyaccounts: []) is authoritative.
If accounts reappear:
- check for multiple plugin installs writing concurrently
- check external scripts touching auth files
- stop OpenCode before manually editing
codex-accounts.json(plugin writes are lock-guarded + atomic and can overwrite ad-hoc edits)
Meaning:
- auth storage JSON could not be parsed, so the plugin moved the file to quarantine and continued with empty auth state.
Where quarantine files go:
- default:
<auth-file-dir>/quarantine/ - filename pattern:
<original>.<timestamp>.quarantine.json
Recovery:
- stop OpenCode
- inspect and repair the quarantined JSON backup
- copy the repaired file back to
codex-accounts.json - rerun
opencode auth loginif needed to refresh tokens/identity metadata
Enable:
OPENCODE_OPENAI_MULTI_DEBUG=1- or
DEBUG_CODEX_PLUGIN=1 CODEX_AUTH_DEBUG=1(OAuth lifecycle logs; supportstrue|yes|on)
Optional request/response snapshots:
OPENCODE_OPENAI_MULTI_HEADER_SNAPSHOTS=trueOPENCODE_OPENAI_MULTI_HEADER_TRANSFORM_DEBUG=true(addsbefore-header-transformandafter-header-transform)- output in
<config-root>/logs/codex-plugin/ - snapshot custom metadata is nested under
metain snapshot JSON payloads.
Redirect safety errors:
blocked_outbound_redirect: request hit a redirect that failed policy validation.outbound_redirect_limit_exceeded: request exceeded redirect hop cap.
Optional OAuth timing controls:
CODEX_OAUTH_CALLBACK_TIMEOUT_MSCODEX_OAUTH_SERVER_SHUTDOWN_GRACE_MSCODEX_OAUTH_SERVER_SHUTDOWN_ERROR_GRACE_MSCODEX_OAUTH_HTTP_TIMEOUT_MSCODEX_DEVICE_AUTH_TIMEOUT_MS
Optional OAuth debug log rotation:
CODEX_AUTH_DEBUG_MAX_BYTES
Safer issue-reporting path:
OPENCODE_OPENAI_MULTI_SHAREABLE_DEBUG=1- Writes a bounded
shareable-debug.jsonlsummary log under the plugin log directory. - Keeps a rolling pseudonymized buffer under
shareable-debug-state/segments/. - On auth/fatal trigger conditions, writes dedicated incident captures under
shareable-debug-state/incidents/. - Use this when you need logs that are intended to be safe to paste into a public issue.
- Writes a bounded
Sensitive auth headers/tokens are redacted in snapshot logs. Sensitive account/session metadata keys and URL query values are redacted as well. If request body capture is enabled, prompt/tool payload content may still be present.
For complete config/env reference, see docs/configuration.md.