What causes "%s produced empty output" in alibaba/open-code-review?

Run the command manually and confirm it actually prints a value to stdout

produced empty output

Error message

%s produced empty output

What it means

After trimming whitespace, an empty command output cannot be a credential, so the loader returns this explicit error rather than propagating an empty key that would later fail as an empty Authorization header.

Solutions

Run the command manually and confirm it actually prints a value to stdout
Fix the item path/field selector in the secrets command (wrong vault item or field name)
Remove redirections that swallow stdout; make the script write to stdout with echo/printf
Verify the credential field is not empty in the secrets manager

Example fix

// before
keyCmd: "op read 'op://vault/item/missing-field' > /dev/null"
// after
keyCmd: "op read 'op://vault/item/api-key/credential'"

Defensive patterns

Strategy: validation

Validate before calling

out, _ := exec.Command("sh", "-c", "<your-key-cmd>").Output()
if len(strings.TrimSpace(string(out))) == 0 { /* empty; check item path and redirections */ }

Prevention

Confirm the secret item/field exists and is non-empty before configuring
Avoid redirecting stdout away in the key command
Run the helper interactively once to see what it prints

When it happens

Trigger: The key command exits 0 but prints nothing — silent helper failure, wrong secret path/item, a command writing the token to a file instead of stdout, or output swallowed by redirection.

Common situations: pass/op/1password item path pointing at a nonexistent or empty field; helper script exiting before the echo; shell redirection sending the credential to stderr or a file.

Related errors

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/e690fc0cee4bda14. Report an issue: GitHub.

Appendix: source

Thrown at internal/llm/keycmd.go:130

	// Same reason as the line-break check, wider net: httpguts.ValidHeaderFieldValue
	// (what net/http enforces) rejects every byte below 0x20 except SP and TAB, plus
	// DEL. A NUL or VT smuggled in by e.g. `printf 'sk-a\0b'` would otherwise reach
	// net/http as the opaque `invalid header field value for "Authorization"`.
	//
	// Deliberately before the TrimSpace below, so a trailing control byte is an
	// error naming its offset rather than silently stripped: only TAB, SP and the
	// line breaks already handled above are things a credential command can
	// plausibly append by accident. Offsets are therefore into the pre-TrimSpace
	// string, which is what the command actually produced.
	for i := 0; i < len(trimmed); i++ {
		if b := trimmed[i]; (b < 0x20 && b != '\t') || b == 0x7f {
			return "", fmt.Errorf("%s produced a control byte 0x%02X at offset %d; a credential must not contain control characters", label, b, i)
		}
	}

	key := strings.TrimSpace(trimmed)
	if key == "" {
		return "", fmt.Errorf("%s produced empty output", label)
	}
	return key, nil
}

View on GitHub (pinned to 5cf97d0d15)