HKUDS/Vibe-Trading · error · RuntimeError

{source} produces an invalid multiline HTTP header ({name!r}

Error message

{source} produces an invalid multiline HTTP header ({name!r}).

What it means

Raised by _validate_explicit_headers when an explicit header value contains \r or \n. Multiline header values enable header injection/smuggling attacks and are rejected by httpcore, so the library blocks them before the request is sent.

Source

Thrown at agent/src/providers/llm.py:778

        )
    if any(ord(char) < 33 or ord(char) > 126 for char in value):
        raise RuntimeError(
            f"{source} contains whitespace or control characters and cannot be "
            "sent in an HTTP Authorization header. Replace it with the raw "
            "provider API key."
        )


def _validate_explicit_headers(headers: Mapping[str, str], *, source: str) -> None:
    """Reject explicit provider headers that HTTPX cannot encode safely."""
    for name, value in headers.items():
        if not name.isascii() or not value.isascii():
            raise RuntimeError(
                f"{source} produces a non-ASCII HTTP header ({name!r}). "
                "Use an ASCII-only header value."
            )
        if "\r" in value or "\n" in value:
            raise RuntimeError(
                f"{source} produces an invalid multiline HTTP header ({name!r})."
            )


def _redact_proxy_url(name: str, raw: str | None) -> str:
    """Return a credential-free proxy URL label."""
    if not raw:
        return "unset"
    if name.upper().endswith("NO_PROXY"):
        return "set"
    return _redact_base_url_for_log(raw)


def _deepseek_adapter_mode() -> str:
    """Return the configured DeepSeek adapter mode."""
    mode = get_env_config().llm.vibe_trading_deepseek_adapter.strip().lower()
    aliases = {
        "compat": "openai-compatible",

View on GitHub (pinned to 80ffdda44c)

Solutions

1. Strip line endings from the value: value.replace('\r','').replace('\n','').strip()
2. Split the intended content into separate header entries, one per header
3. Audit where the value originates and fix the producer to emit a single-line string

Example fix

# before
headers = {"Authorization": f"Bearer {token}\n"}

# after
headers = {"Authorization": f"Bearer {token.strip()}"}

safe = {k: v.replace('\r', '').replace('\n', '').strip() for k, v in extra_headers.items()}

When it happens

Trigger: Passing an extra header whose value includes a newline, e.g. a formatted API key, a cookie string with line breaks, or an accidentally interpolated multi-line template string.

Common situations: Using a triple-quoted string or f-string spanning lines as a header value; pasting keys copied from emails/docs that contain trailing newlines; attempting to smuggle multiple headers as one value.

Related errors

• {source} produces a non-ASCII HTTP header ({name!r}). Use an
• Invalid swarm agent id {agent_id!r}: artifact path escapes t
• artifact_path escapes the current run_dir
• invalid alpha_id
• alpha_id not found

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/8968d24c22d73a7f. Report an issue: GitHub.