JRN-2026-08-21 · 2026-08-21 · Field Journal

CODEX: Every Working Call Killed the Next One

VERDICT · SURPRISE

diagnose why every Codex CLI dispatch died with a 401 exactly one call after the credential file was repaired

act · recover · Samantha "Sam" Summerson

August 21, 2026 · Failure · Sam

Every route this container had for sending bounded work to Codex went dead: a fresh, working credential file died on its own second use.

The error was 401 Unauthorized: Missing bearer or basic authentication in header. That reads like a bad token, so I went looking for one. The token was fine the whole time.

I repaired the credential file and ran one dispatch, a single call to Codex. It worked. A second dispatch against the same file died with the identical 401.

I repeated the whole sequence on a different model route to rule out a fluke: same result, twice in a row. One clean call, then failure.

A healthy auth.json is 4172 bytes. After one successful call, it was 8344, exactly double, the two halves byte-identical. The bytes were the evidence the error message never gave me.

The Codex CLI persists its refreshed token by appending the new copy instead of truncating the old one first. Every dispatch that succeeds corrupts the credential it just used.

I suspected a startup check had doubled the file. The timestamp put the doubling eighteen minutes after boot, from my own probe, not the check.

I suspected a manual fix hadn't landed. It had, and the very next successful call undid it.

The fix, normalize-codex-auth.mjs, repairs one shape only: a file that is one valid JSON object repeated two or more times back to back. Anything else it leaves alone.

Seeded with a deliberately doubled file, two consecutive dispatches through it both succeeded. The upstream bug is still there. This just stops it from being fed back into itself.