{"record":{"id":"13072bee262a8215","repo":"can1357/oh-my-pi","slug":"auth-broker-returned-no-snapshot","errorCode":null,"errorMessage":"Auth broker returned no snapshot","messagePattern":"Auth broker returned no snapshot","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/cli/auth-broker-cli.ts","lineNumber":772,"sourceCode":"\treturn false;\n}\n\nasync function runMigrate(flags: AuthBrokerCommandArgs[\"flags\"]): Promise<void> {\n\tconst brokerConfig = await resolveAuthBrokerConfig();\n\tif (!brokerConfig) {\n\t\tthrow new Error(\n\t\t\t\"OMP_AUTH_BROKER_URL must be set (or `auth.broker.url` in config.yml). `migrate` uploads local credentials to a configured broker.\",\n\t\t);\n\t}\n\tif (flags.fromLocal !== true) {\n\t\tthrow new Error(\n\t\t\t\"`omp auth-broker migrate` requires an explicit source. Pass `--from-local` to migrate from the local SQLite store and env vars.\",\n\t\t);\n\t}\n\n\tconst client = new AuthBrokerClient({ url: brokerConfig.url, token: brokerConfig.token });\n\tconst snapshotResult = await client.fetchSnapshot();\n\tif (snapshotResult.status !== 200) throw new Error(\"Auth broker returned no snapshot\");\n\tconst existing = indexBrokerSnapshot(snapshotResult.snapshot);\n\n\tconst plan: MigratePlanEntry[] = [];\n\tconst skipped: MigrateSkip[] = [];\n\n\t// 1. Local SQLite rows.\n\tconst localDbPath = getAgentDbPath();\n\tconst localStore = await SqliteAuthCredentialStore.open(localDbPath);\n\tconst plannedApiKeyProviders = new Set<string>();\n\ttry {\n\t\tfor (const row of localStore.listAuthCredentials()) {\n\t\t\t// Skip placeholder sentinels that pi-ai treats as \"authenticated via\n\t\t\t// out-of-band mechanism\" (Bedrock/Vertex `<authenticated>`). They\n\t\t\t// aren't real keys and uploading them would store garbage on the\n\t\t\t// broker. Mirrors the env-var path's guard below.\n\t\t\tif (row.credential.type === \"api_key\" && row.credential.key === \"<authenticated>\") {\n\t\t\t\tskipped.push({\n\t\t\t\t\tsource: \"local-sqlite\",","sourceCodeStart":754,"sourceCodeEnd":790,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/cli/auth-broker-cli.ts#L754-L790","documentation":"The `omp auth-broker migrate` command builds a migration plan from the broker's current credential snapshot. After calling AuthBrokerClient.fetchSnapshot(), it requires HTTP status 200; anything else means the broker did not return usable snapshot data, so a plain Error is thrown rather than proceeding with an empty/partial snapshot. This guards against silently migrating from an empty catalog.","triggerScenarios":"Running `omp auth-broker migrate` when the broker responds with a non-200 status (e.g. 401 invalid token, 404 wrong URL path, 5xx broker failure, network proxy error).","commonSituations":"Misconfigured OMP_AUTH_BROKER_URL or auth.broker.url in config.yml; expired/rotated auth.broker.token; broker service down or upgraded behind a reverse proxy returning error pages.","solutions":["Check `omp auth-broker` connectivity: verify OMP_AUTH_BROKER_URL (or auth.broker.url/token in config.yml) points at a live broker.","Verify the broker token is valid and not expired/rotated — a 401 is the most common non-200.","Curl the broker's snapshot endpoint manually with the same URL and bearer token to see the actual status/body.","Retry once the broker service is healthy if it returned 5xx."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const cfg = await resolveAuthBrokerConfig();\nif (!cfg) throw new Error(\"Broker URL/token not configured\");\n// optionally: const res = await fetch(cfg.url + \"/snapshot\", { headers: { Authorization: `Bearer ${cfg.token}` } });\n// if (!res.ok) fail fast with res.status","typeGuard":"function hasSnapshot(r: { status: number; snapshot?: unknown }): r is { status: 200; snapshot: unknown } {\n  return r.status === 200 && r.snapshot !== undefined;\n}","tryCatchPattern":"try {\n  const snap = await client.fetchSnapshot();\n  if (snap.status !== 200) throw new Error(`broker snapshot HTTP ${snap.status}`);\n} catch (err) {\n  logger.error(\"auth-broker snapshot unavailable\", { err });\n  process.exitCode = 1;\n}","preventionTips":["Validate auth.broker.url/token before running migrate","Health-check the broker endpoint before long migrations","Rotate tokens centrally and update env/config immediately"],"tags":["auth-broker","http-status","network"],"backgroundTag":"non-200-http-response","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}