Sites source retrieval: git-upload-pack returns HTTP 500 after successful authentication (Work and local Codex)

What version of Codex CLI is running?

codex-cli 0.153.4

This version and the OS/configuration details below were collected after the original 2026-09-09 reproduction; they are not a verified historical snapshot of the CLI version/configuration at that time.

What subscription do you have?

ChatGPT account using Sites and Codex. The exact subscription label at the time of the original reproduction was not recorded.

What platform is your computer?

Ubuntu 24.04.4 LTS (Noble Numbat).

$ uname -srm
Linux 7.0.0-31-generic x86_64

Git used for the external local reproduction: git version 2.43.0.

Codex doctor report

Not collected. OpenAI Support specifically requested /debug-config; that output is included below.

What issue are you seeing?

Source retrieval for my existing Kubokot — Wiki Sites project fails during Git packfile download from git.chatgpt-team.site. It has been reproduced through both ChatGPT Work and external local Codex.

Native Sites authorization succeeds and confirms owner access. Authenticated git ls-remote succeeds. During clone:

1. GET info/refs returns HTTP 200.
2. The initial POST git-upload-pack returns HTTP 200.
3. The subsequent, longer POST git-upload-pack returns HTTP 500.
4. Git exits with code 128:

error: RPC failed; HTTP 500 curl 22 The requested URL returned error: 500
fatal: expected 'packfile'

No working source checkout was obtained. This blocks continued development and creation of a source backup/export.

What steps can reproduce the bug?

Uploaded thread: 01a0854d-6806-7d81-9ff8-bd2d794e8235

OpenAI Support requested the uploaded session logs for the existing support case.

1. Use the supported Sites integration to obtain a temporary, repository-scoped credential for the existing project.
2. Confirm authenticated access with git ls-remote.
3. Clone into a fresh directory using the returned credential as a per-command HTTP header.
4. Observe the HTTP 200 responses followed by HTTP 500 during packfile retrieval.

Sanitized command shape; placeholders are intentional:

git -c http.version=HTTP/1.1 \
    -c "http.extraHeader=Authorization: Bearer <REDACTED>" \
    clone --single-branch --no-tags --branch main \
    "https://git.chatgpt-team.site/<workspace>/<project>.git" \
    "<fresh-destination>"

A second attempt used the same options plus --depth 1. Both failed. Full clone took 115.934 seconds in total; shallow clone took 123.955 seconds in total. No imposed timeout, forced termination, or automatic retries were used. A Python launcher measured execution time and sanitized diagnostics.

The exact repository coordinates are in the existing private support case.

What is the expected behavior?

Authenticated source retrieval should complete and produce a usable checkout. If this requires investigation by the Sites service team, please route the report appropriately. A supported export of the current source would also unblock work while retrieval is being repaired.

Additional information

Correlation identifiers

Environment / attempt	Date from HTTP 500 response (UTC)	CF-Ray	Last POST to response headers
External local Codex, full clone	Wed, 09 Sep 2026 08:39:18 GMT	a384deeb2add66be-AMS	114.001 s
External local Codex, shallow clone	Wed, 09 Sep 2026 08:41:46 GMT	a384e259bd24fba6-AMS	121.906 s
ChatGPT Work, shallow clone	Sat, 12 Sep 2026 21:49:57 GMT	a3a21e888efdae29-ORD	approximately 60.161 s

Earlier Work attempts also failed with HTTP/2 and HTTP/1.1. A Work attempt using --filter=blob:none reported filtering not recognized by server, ignoring and failed as well.

These are observed durations, not evidence of one fixed timeout. Cloudflare response headers and CF-Ray values do not by themselves identify whether the failure originated at the edge, an intermediary, or the Git backend. The CF-Ray suffixes are not being asserted as the execution environments' locations.

Requested /debug-config output

Home-directory prefix redacted; remaining output preserved:

Config layer stack (lowest precedence first):
  1. packaged defaults (<USER_HOME>/.codex/packages/standalone/releases/0.153.4-x86_64-unknown-linux-musl/bin/codex) (enabled)
  2. system (/etc/codex/config.toml) (enabled)
  3. user (<USER_HOME>/.codex/config.toml) (enabled)

Requirements:
  <none>

[agents]:
  - enabled = true
  - max_concurrent_threads_per_session = <unset>
  - max_depth = 1 (V1 only; ignored by V2)
  - default_subagent_model = <unset>
  - default_subagent_reasoning_effort = <unset>
  - interrupt_message = true

Requirements: <none> is not a claim that the environment has no network restrictions.

A separate initial local sandbox-launch error (bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted) was recorded. The subsequently authorized execution did run Git and reached the HTTP 500 failures documented above.

Support acknowledged that browser HAR is not applicable to this CLI reproduction and that further reproductions solely for a screen recording are not required. Existing Git diagnostics have already been supplied, and the session feedback has now been uploaded. No server-side export or completed engineering review has been confirmed.

Start with the sanitized git clone command and the uploaded session logs for thread 01a0854d-6806-7d81-9ff8-bd2d794e8235. Compare the successful authenticated git ls-remote and initial git-upload-pack response with the later HTTP 500 responses, using the listed timings and CF-Ray identifiers. Done means source retrieval completes with a usable checkout, or the failure is routed to the responsible Sites service team with a supported export provided.