[saphid]

Problem

When Codex text generation fails (commit messages, PR text, branch names, thread titles, PR review guides), the error shows Codex's startup banner and the whole prompt, not a short failure. In human mode, codex exec writes its banner (version, workdir, model, session id) to stderr, then repeats the full prompt, including any diff, under user. Only after that does it print ERROR: … lines. runCodexJson copied all of stderr into the error detail, so the toast or failed review guide starts with OpenAI Codex v0.160.0 -------- and the prompt follows.

#26033 diagnosed this, and #26073 fixed the Guide tab layout. That PR says: "Trimming the Codex stderr on the server is a separate fix and is not included." This PR is that fix.

Change

This follows docs/internals/effect-services.md "Errors": an error detail is fixed or built from structured attributes, and raw provider output lives only in cause.

• On a non-zero exit, the detail is now fixed: Codex CLI command failed with code N. It contains no Codex output.
• Codex's own failure text goes into cause. That is stderr from the last ERROR: line to the end, without the prefix, so earlier retry notices such as ERROR: Reconnecting... 5/5 are skipped. If there is no ERROR: line, cause gets trimmed stderr, or else stdout.

codex exec has no structured failure category to map. I ran the real CLI with --json, and its terminal event is {"type":"turn.failed","error":{"message":"unexpected status 401 …"}}, which has only a message. The exit code is 1 for every failure. The detail therefore uses one fixed message, not a per-category mapping. The chat adapter's codexErrorInfo categories come from app-server and are not available from codex exec.

Scope and approval

This is a very small, focused fix for an obvious bug, so there is no prior issue. It is the follow-up named in #26073 for the problem diagnosed in #26033. It changes one function in one file, with one test. Overlap search: the local PR index plus GitHub searches for "codex stderr" and "CodexTextGeneration". Open PRs #29607, #26979, and #14217 touch Codex text generation but not this error path.

Verification

• Real Codex: I ran codex-cli 0.160.0 unauthenticated with an isolated CODEX_HOME. It exited 1. Human-mode stderr had the banner, the echoed prompt, ERROR: Reconnecting... N/5, and then a final ERROR: unexpected status 401 Unauthorized: …. --json mode gave the same message-only turn.failed event shown above.
• Test keeps Codex's banner, prompt, and error text out of the failure detail in CodexTextGeneration.test.ts asserts three things: the detail is exactly Codex CLI command failed with code 1., it does not contain the provider text, and cause holds the final 401 message. On the previous head it failed with Received: "Codex CLI command failed: unexpected status 401 Unauthorized: Missing bearer authentication". Full file: 15/15 pass.
• vp run check:changed: format, lint, knip, graphql, typecheck (3 packages), and tests (16/16) all pass.
• Not checked: a live failure with a signed-in account, such as a usage-limit error. The detail is the same fixed text for any non-zero exit.

Reviewed with sol-loop: 1 round with GPT-6.1 Sol on high. Sol verdict: approved.

Created with Claude Opus 5.5 in Claude Code (T3 Code).

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Would Approve

Macroscope's review found this PR approvable — Failed Codex text generation now uses an exit-code-only message and moves CLI diagnostics into the error cause, avoiding echoed prompts in the displayed detail. The supplied High finding about lost actionable diagnostics remains independently blocking.

Needs human approval because:

• 1 blocking correctness issue found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

When Codex exits with a nonzero status, the failure detail now reports the exit code. Extracted output is attached as the cause. A test checks that mixed stderr output does not replace the failure detail and that the authentication error is retained in the cause.

Changes: Codex failure reporting

Layer / File(s)	Summary
Separate failure detail from output apps/server/src/textGeneration/CodexTextGeneration.ts, apps/server/src/textGeneration/CodexTextGeneration.test.ts	The failure detail now reports the exit code. The cause uses the last stderr line beginning with ERROR: , or falls back to trimmed stderr and then stdout. The test checks mixed stderr output and verifies that the authentication error is retained in the cause.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: maria-rcks

Merge Risk: Minimal · up to da68b

No actionable merge risk remains identified; Codex failures now expose the fixed exit-code detail while retaining diagnostics as the error cause.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title is concise, specific, and accurately describes the main change: preventing the echoed prompt from appearing in failed Codex text-generation errors.
Description check		The description includes all required sections. It clearly explains the problem, implementation, scope justification, tests, observed results, and limitations.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

ast-grep (0.51.1)

ast-grep could not parse rule config: /ast-grep-rules/ast-grep-essentials/rules/swift/security/blowfish-hardcoded-secret-swift.yml

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: f6503f0
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0bfa82ae-da50-4da0-802b-76f78b882238

Commits

Reviewing files that changed from the base of the PR and between e026556 and da68b1c.

Files selected for processing: 2

• apps/server/src/textGeneration/CodexTextGeneration.test.ts
• apps/server/src/textGeneration/CodexTextGeneration.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

Dismissing prior approval to re-evaluate da68b1c

[saphid]

Note

🤖 Claude Opus 5.5 responding on behalf of saphid

I reworked this PR to follow the documented error rule in docs/internals/effect-services.md "Errors". An error detail must be fixed or built from structured attributes, and raw provider output stays in cause.

• The detail is now fixed: Codex CLI command failed with code N.
• Codex's final ERROR: line (or stderr/stdout when there is none) is now only in cause.
• Mapped categories: none. codex exec provides no structured failure category. Its --json turn.failed event has only error.message, and the exit code is 1 for every failure. So every non-zero exit gets the one fixed detail.

Commit: da68b1c

[macroscopeapp]

🟠 High textGeneration/CodexTextGeneration.ts:346

For nonzero Codex exits, callers receive only Codex CLI command failed with code ..., so authentication, configuration, or usage failures become unrecoverable. protect rebuilds the error from cause.detail and discards the nested cause; include the extracted output in detail so the actionable CLI error survives.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/server/src/textGeneration/CodexTextGeneration.ts around line 346:

For nonzero Codex exits, callers receive only `Codex CLI command failed with code ...`, so authentication, configuration, or usage failures become unrecoverable. `protect` rebuilds the error from `cause.detail` and discards the nested `cause`; include the extracted `output` in `detail` so the actionable CLI error survives.

[saphid]

Note

🤖 Claude Opus 5.5 responding on behalf of saphid

Leaving this as is for now, and flagging it for maintainers because it's a deliberate trade-off. docs/internals/effect-services.md "Errors" says a tagged error's message is fixed or built from structured attributes, never from raw provider text. The raw value belongs only in cause. codex exec gives no structured failure category, only an exit code and stderr. That stderr starts with the banner, the full prompt and the staged patch, which is the leak this PR fixes. So the detail is the fixed Codex CLI command failed with code N., and the extracted ERROR: text stays on the error as its cause (CodexTextGeneration.ts:343-347). maria-rcks confirmed the toast in a real run: main showed the banner, prompt and patch, and this PR shows only the fixed line.

On protect: there's no such helper at da68b1c. The one place that rebuilds an error from cause.detail (line 240) is the runtime-resolve path. It's unchanged from main and never sees CLI output.

If maintainers want auth or usage failures to be actionable from the toast, two options fit the rule. One is a bounded diagnostic field like DeviceBootError.diagnostics, which caps the extracted ERROR: line. The other is mapping known codex exit conditions to fixed categories. I'm happy to do either. I didn't want to put raw provider text back into the detail without that decision.

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

Verified in a real dev environment

verified as-is at da68b1cfb8688542ad9a24a47bb4f38e68b21684 on a disposable linux vm using the real dev web app, repository Playwright, /usr/bin/google-chrome, and Codex CLI 0.164.0 through the local provider proxy. no code changes or pushes.

created a git project through the app, selected Codex gpt-6.1-sol, and sent a real turn that changed README.md. stopped main before starting the exact pr head. reused the same app-created project, thread, and staged diff for the comparison.

• on github/main (61c3794c32), clicked Commit with automatic message generation. configured the real Codex provider base URL to the proxy's nonexistent /invalid route through Settings. its HTTP 404 caused the toast to contain the Codex banner, full commit prompt, and staged patch.
• on this pr, repeated the same click and failure. the complete toast detail was Text generation failed in generateCommitMessage: Codex CLI command failed with code 1. no banner, prompt, patch, or provider error text appeared.
• restored the provider endpoint through Settings and clicked Commit again. real gpt-6.1-sol message generation succeeded and created commit 29cfd93 (docs: simplify readme to a plain project description) in the verification project. its working tree was clean.
• sent another real Codex gpt-6.1-sol turn through the composer. it read README.md and returned codex text generation verification VERIFIED without changing files.

short runtime/check transcript:

main: vp i; vp run dev (background), server 16733 / web 8693
main commit failure: Codex CLI command failed: OpenAI Codex v0.164.0 ... user ... Staged patch ... ERROR: unexpected status 404 Not Found
pr: vp i; vp run dev --home-dir /home/user/t3code/.t3 (background), server 13773 / web 5733
pr commit failure: Codex CLI command failed with code 1.
restored endpoint: generated commit 29cfd93; git status --porcelain => empty
blacksmith: vp test run apps/server/src/textGeneration/CodexTextGeneration.test.ts => 15 passed
blacksmith: vp run check:changed f6503f0e717f5d577a897149b4ceeb3d1bf00b3a
=> format, lint, knip, graphql, typecheck (3 packages), tests (16/16) passed

the Blacksmith snapshot needed its public pr ancestry fetched before check:changed could find the comparison base. no local checks substituted for it.

Not verified

native desktop, iOS/Android, remote/relay/tunnel connections, live authentication or quota failures, and the other text-generation entry points (branch names, PR content, review guides, and title failure). the exercised failure was a real HTTP 404 from the local proxy, not a usage-limit simulation. the provider diagnostic cause is intentionally absent from the client toast; this pass proves the displayed detail, not access to that cause from a client.