%s produced multi-line output; expected a single credential

Error message

%s produced multi-line output; expected a single credential (pipe through 'head -n1' if your command prints more)

What it means

Credentials must be a single line. After trimming only trailing CR/LF, any remaining newline or carriage return means ambiguous multi-line output, which is refused with this actionable message. Interior CR is caught too, because a CR inside an Authorization header makes net/http fail with an opaque error.

Source

Thrown at internal/llm/keycmd.go:110

		return "", fmt.Errorf("%s produced more than 64KiB of output", label)
	}
	// ErrWaitDelay only means an orphaned grandchild still holds the pipe; the
	// command itself exited fine and its output is already buffered, so use it
	// rather than surfacing an exec-internal error.
	if err != nil && !errors.Is(err, exec.ErrWaitDelay) {
		// Covers non-zero exit and command-not-found (the shell exits non-zero
		// and prints its not-found message on the child's stderr). ExitError.Stderr
		// stays nil because we assigned c.Stderr, so no output can leak here.
		return "", fmt.Errorf("%s failed: %w", label, err)
	}

	// Trim a trailing line break; multi-line output past that is ambiguous and refused.
	// ContainsAny (not Contains "\n") so a lone interior CR is caught too: TrimRight
	// leaves it, TrimSpace below only strips the edges, and a CR inside a credential
	// makes net/http reject the Authorization header with an opaque error.
	trimmed := strings.TrimRight(out.buf.String(), "\r\n")
	if strings.ContainsAny(trimmed, "\n\r") {
		return "", fmt.Errorf("%s produced multi-line output; expected a single credential (pipe through 'head -n1' if your command prints more)", label)
	}
	// Same reason as the line-break check, wider net: httpguts.ValidHeaderFieldValue
	// (what net/http enforces) rejects every byte below 0x20 except SP and TAB, plus
	// DEL. A NUL or VT smuggled in by e.g. `printf 'sk-a\0b'` would otherwise reach
	// net/http as the opaque `invalid header field value for "Authorization"`.
	//
	// Deliberately before the TrimSpace below, so a trailing control byte is an
	// error naming its offset rather than silently stripped: only TAB, SP and the
	// line breaks already handled above are things a credential command can
	// plausibly append by accident. Offsets are therefore into the pre-TrimSpace
	// string, which is what the command actually produced.
	for i := 0; i < len(trimmed); i++ {
		if b := trimmed[i]; (b < 0x20 && b != '\t') || b == 0x7f {
			return "", fmt.Errorf("%s produced a control byte 0x%02X at offset %d; a credential must not contain control characters", label, b, i)
		}
	}

	key := strings.TrimSpace(trimmed)

View on GitHub (pinned to 5cf97d0d15)

Solutions

Pipe the command through head -n1 as the error suggests, or select the credential with jq -r / awk
Fix the helper script to print only the single credential on stdout
Convert CRLF output to LF (dos2unix or tr -d '\r') if the source emits Windows line endings
Extract the exact field (e.g. --query ... --output text) instead of printing the whole payload

Example fix

// before
keyCmd: "my-login-tool"
// after
keyCmd: "my-login-tool | head -n1"

Defensive patterns

Strategy: validation

Validate before calling

out, _ := exec.Command("sh", "-c", "<your-key-cmd>").Output()
if strings.ContainsAny(strings.TrimRight(string(out), "\r\n"), "\n\r") { /* multi-line; fix command */ }

Prevention

Pipe through head -n1 when the tool prints extra lines
Convert CRLF output (dos2unix, tr -d '\r') for Windows-sourced output
Emit exactly one line from helper scripts

When it happens

Trigger: The key command prints the credential plus additional lines — banners, labels (e.g. `echo "token: abc"`), pretty-printed JSON, or CRLF line endings from Windows-style output.

Common situations: Helper scripts echoing a label before the key; commands printing two values; Windows-produced files with CRLF read by the command; AWS CLI returning a wrapped multi-line value.

Related errors

AI-assisted analysis of alibaba/open-code-review@5cf97d0d15 (2026-09-02). Data as JSON: /api/errors/da63bfd9e3979eb7. Report an issue: GitHub.