{"record":{"id":"e690fc0cee4bda14","repo":"alibaba/open-code-review","slug":"s-produced-empty-output","errorCode":null,"errorMessage":"%s produced empty output","messagePattern":"(.+?) produced empty output","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/llm/keycmd.go","lineNumber":130,"sourceCode":"\t// Same reason as the line-break check, wider net: httpguts.ValidHeaderFieldValue\n\t// (what net/http enforces) rejects every byte below 0x20 except SP and TAB, plus\n\t// DEL. A NUL or VT smuggled in by e.g. `printf 'sk-a\\0b'` would otherwise reach\n\t// net/http as the opaque `invalid header field value for \"Authorization\"`.\n\t//\n\t// Deliberately before the TrimSpace below, so a trailing control byte is an\n\t// error naming its offset rather than silently stripped: only TAB, SP and the\n\t// line breaks already handled above are things a credential command can\n\t// plausibly append by accident. Offsets are therefore into the pre-TrimSpace\n\t// string, which is what the command actually produced.\n\tfor i := 0; i < len(trimmed); i++ {\n\t\tif b := trimmed[i]; (b < 0x20 && b != '\\t') || b == 0x7f {\n\t\t\treturn \"\", fmt.Errorf(\"%s produced a control byte 0x%02X at offset %d; a credential must not contain control characters\", label, b, i)\n\t\t}\n\t}\n\n\tkey := strings.TrimSpace(trimmed)\n\tif key == \"\" {\n\t\treturn \"\", fmt.Errorf(\"%s produced empty output\", label)\n\t}\n\treturn key, nil\n}\n","sourceCodeStart":112,"sourceCodeEnd":134,"githubUrl":"https://github.com/alibaba/open-code-review/blob/5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f/internal/llm/keycmd.go#L112-L134","documentation":"After trimming whitespace, an empty command output cannot be a credential, so the loader returns this explicit error rather than propagating an empty key that would later fail as an empty Authorization header.","triggerScenarios":"The key command exits 0 but prints nothing — silent helper failure, wrong secret path/item, a command writing the token to a file instead of stdout, or output swallowed by redirection.","commonSituations":"pass/op/1password item path pointing at a nonexistent or empty field; helper script exiting before the echo; shell redirection sending the credential to stderr or a file.","solutions":["Run the command manually and confirm it actually prints a value to stdout","Fix the item path/field selector in the secrets command (wrong vault item or field name)","Remove redirections that swallow stdout; make the script write to stdout with echo/printf","Verify the credential field is not empty in the secrets manager"],"exampleFix":"// before\nkeyCmd: \"op read 'op://vault/item/missing-field' > /dev/null\"\n// after\nkeyCmd: \"op read 'op://vault/item/api-key/credential'\"","handlingStrategy":"validation","validationCode":"out, _ := exec.Command(\"sh\", \"-c\", \"<your-key-cmd>\").Output()\nif len(strings.TrimSpace(string(out))) == 0 { /* empty; check item path and redirections */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm the secret item/field exists and is non-empty before configuring","Avoid redirecting stdout away in the key command","Run the helper interactively once to see what it prints"],"tags":["credentials","exec","empty-output"],"backgroundTag":"empty-credential-output","analyzedSha":"5cf97d0d15cbd41b602513c4be3bfec3cee5bf7f","analyzedAt":"2026-09-02T02:08:09.116Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}