What causes "%s produced empty output" in alibaba/open-code-review?

Run the command manually and confirm it actually prints a value to stdout

%s produced empty output

Error message

%s produced empty output

What it means

After trimming whitespace, an empty command output cannot be a credential, so the loader returns this explicit error rather than propagating an empty key that would later fail as an empty Authorization header.

Source

Thrown at internal/llm/keycmd.go:130

	// Same reason as the line-break check, wider net: httpguts.ValidHeaderFieldValue
	// (what net/http enforces) rejects every byte below 0x20 except SP and TAB, plus
	// DEL. A NUL or VT smuggled in by e.g. `printf 'sk-a\0b'` would otherwise reach
	// net/http as the opaque `invalid header field value for "Authorization"`.
	//
	// Deliberately before the TrimSpace below, so a trailing control byte is an
	// error naming its offset rather than silently stripped: only TAB, SP and the
	// line breaks already handled above are things a credential command can
	// plausibly append by accident. Offsets are therefore into the pre-TrimSpace
	// string, which is what the command actually produced.
	for i := 0; i < len(trimmed); i++ {
		if b := trimmed[i]; (b < 0x20 && b != '\t') || b == 0x7f {
			return "", fmt.Errorf("%s produced a control byte 0x%02X at offset %d; a credential must not contain control characters", label, b, i)
		}
	}

	key := strings.TrimSpace(trimmed)
	if key == "" {
		return "", fmt.Errorf("%s produced empty output", label)
	}
	return key, nil
}

View on GitHub (pinned to 5cf97d0d15)

Solutions

Run the command manually and confirm it actually prints a value to stdout
Fix the item path/field selector in the secrets command (wrong vault item or field name)
Remove redirections that swallow stdout; make the script write to stdout with echo/printf
Verify the credential field is not empty in the secrets manager

Example fix

// before
keyCmd: "op read 'op://vault/item/missing-field' > /dev/null"
// after
keyCmd: "op read 'op://vault/item/api-key/credential'"

Defensive patterns

Strategy: validation

Validate before calling

out, _ := exec.Command("sh", "-c", "<your-key-cmd>").Output()
if len(strings.TrimSpace(string(out))) == 0 { /* empty; check item path and redirections */ }

Prevention

Confirm the secret item/field exists and is non-empty before configuring
Avoid redirecting stdout away in the key command
Run the helper interactively once to see what it prints

When it happens

Trigger: The key command exits 0 but prints nothing — silent helper failure, wrong secret path/item, a command writing the token to a file instead of stdout, or output swallowed by redirection.

Common situations: pass/op/1password item path pointing at a nonexistent or empty field; helper script exiting before the echo; shell redirection sending the credential to stderr or a file.

Related errors

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/e690fc0cee4bda14. Report an issue: GitHub.