Hmbown/CodeWhale · error · anyhow::Error

credential handoff was empty

Error message

credential handoff was empty

What it means

Raised in handoff_secret_line when the credential handoff payload resolved to an empty string. The handoff contract is to write exactly the secret plus one newline to the consumer (pipe or terminal); an empty secret would settle the pipe with no credential, so it is treated as a resolution failure and redacted rather than emitted.

Source

Thrown at crates/cli/src/credential_handoff.rs:66

                .as_deref()
                .is_some_and(auth_mode_uses_kimi_imported_token);
        ensure!(!kimi_bearer, "bearer credentials are not an API key");
    }
    ensure!(source.is_some(), "no runtime-effective API key");
    resolved
        .api_key
        .filter(|value| !value.trim().is_empty())
        .context("no usable runtime-effective API key")
}

pub(crate) fn handoff_secret_line(
    writer: &mut impl Write,
    stdout_is_terminal: bool,
    resolve: impl FnOnce() -> Result<String>,
) -> Result<()> {
    prepare_stdout(stdout_is_terminal)?;
    let secret = Zeroizing::new(resolve().map_err(|_| anyhow::anyhow!("unavailable credential"))?);
    ensure!(!secret.trim().is_empty(), "credential handoff was empty");
    let written = writeln!(writer, "{}", secret.as_str());
    if written.is_ok() || written.is_err_and(|error| error.kind() == ErrorKind::BrokenPipe) {
        return Ok(());
    }
    bail!("credential handoff could not write to stdout")
}
#[cfg(test)]
mod tests;

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Re-enter or re-import the API key so the store holds a real value.
2. Check upstream credential import steps for silent failures that left an empty key.

When it happens

Trigger: Thrown at crates/cli/src/credential_handoff.rs:66 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/76608f8e607c55cb. Report an issue: GitHub.