{"record":{"id":"fa8e1bd8954febaa","repo":"gastownhall/beads","slug":"credential-command-output-is-not-a-bare-token-con","errorCode":null,"errorMessage":"credential command output is not a bare token (contains whitespace); expected a token or a JSON {token,expirationTimestamp} envelope","messagePattern":"credential command output is not a bare token \\(contains whitespace\\); expected a token or a JSON (.+?) envelope","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/creds/command.go","lineNumber":175,"sourceCode":"\t\t\ttoken = c.AccessToken\n\t\t}\n\t\tif token == \"\" {\n\t\t\treturn \"\", \"\", time.Time{}, fmt.Errorf(\"credential command JSON has no token/access_token field\")\n\t\t}\n\t\tswitch {\n\t\tcase c.ExpirationTimestamp != \"\":\n\t\t\tif t, perr := time.Parse(time.RFC3339, c.ExpirationTimestamp); perr == nil {\n\t\t\t\texpiry = t\n\t\t\t}\n\t\tcase c.ExpiresIn > 0:\n\t\t\texpiry = time.Now().Add(time.Duration(c.ExpiresIn) * time.Second)\n\t\t}\n\t\treturn token, c.Username, expiry, nil\n\t}\n\n\tbare := string(trimmed)\n\tif strings.ContainsAny(bare, \" \\t\\r\\n\") {\n\t\treturn \"\", \"\", time.Time{}, fmt.Errorf(\"credential command output is not a bare token (contains whitespace); expected a token or a JSON {token,expirationTimestamp} envelope\")\n\t}\n\treturn bare, \"\", time.Time{}, nil\n}\n","sourceCodeStart":157,"sourceCodeEnd":179,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/creds/command.go#L157-L179","documentation":"Bare (non-JSON) credential output is accepted only as a single-line token. If the trimmed output contains any whitespace, it is rejected because multi-word output is almost always an error message that would fail confusingly when used as a credential.","triggerScenarios":"The helper prints a human-readable message on stdout instead of a token — e.g. 'Please run gh auth login', multi-line logs, or a token followed by a trailing explanation sentence.","commonSituations":"Helper writing warnings/prompt text to stdout instead of stderr; a script echoing instructions and then the token on separate lines; ANSI-colored or padded output from a wrapper.","solutions":["Run the credential command manually and look at its stdout — it is printing an error message, not a token.","Fix the helper to send human-readable messages to stderr and write only the token to stdout.","Re-authenticate if the message is an instruction to log in.","Ensure no echo/logging statements in the helper script write to stdout."],"exampleFix":"// before\necho \"Warning: token expires soon\"\necho \"$TOKEN\"\n// after\necho \"Warning: token expires soon\" >&2\nprintf '%s' \"$TOKEN\"","handlingStrategy":"validation","validationCode":"trimmed := bytes.TrimSpace(raw)\nif len(trimmed) > 0 && trimmed[0] != '{' && strings.ContainsAny(string(trimmed), \" \\t\\r\\n\") {\n    // multi-word output: helper is printing prose, not a token; fix first\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Write exactly one token with no trailing newline/formatting (use printf, not echo with extra text).","Route all helper prose to stderr.","Suppress ANSI color and prompts in non-interactive mode."],"tags":["credentials","parsing","output-format"],"backgroundTag":"credential-helper-invalid-output","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}