can1357/oh-my-pi · error

Auth broker returned no initial snapshot

Error message

Auth broker returned no initial snapshot

What it means

fetchBrokerSnapshot wraps AuthBrokerClient.fetchSnapshot() and throws when the HTTP status is not 200, since the gateway's model catalog depends on a valid broker snapshot. This is the same guard as the migrate path but for `omp auth-gateway serve` (via initialSnapshot/snapshot).

Source

Thrown at packages/coding-agent/src/cli/auth-gateway-cli.ts:140

	if (existing) return existing;
	const token = generateToken();
	if (await createTokenExclusive(token)) return token;
	// Another concurrent invocation won the create race; read what they wrote.
	const fromRace = await readToken();
	if (fromRace) return fromRace;
	// File existed-then-disappeared between EEXIST and read; last resort, write
	// our generated token unconditionally so callers don't see an empty string.
	await writeToken(token);
	return token;
}

function createBrokerClient(brokerConfig: AuthBrokerClientConfig): AuthBrokerClient {
	return new AuthBrokerClient({ url: brokerConfig.url, token: brokerConfig.token });
}

async function fetchBrokerSnapshot(client: AuthBrokerClient): Promise<SnapshotResponse> {
	const result = await client.fetchSnapshot();
	if (result.status !== 200) throw new Error("Auth broker returned no initial snapshot");
	return result.snapshot;
}

/**
 * How often a long-lived `serve` rebuilds its catalog from the registry so
 * models discovered after boot become routable without a restart. `refresh()`
 * reuses the `models.db` cache and only hits the network when a provider's
 * cached row is stale, so a short interval stays cheap.
 */
const CATALOG_REFRESH_INTERVAL_MS = 15 * 60 * 1000;

/**
 * Index resolvable models by the request ids clients may send: the
 * provider-qualified `provider/id` (always) and the bare `id` (first-write-wins
 * fallback for legacy clients). Scoped to providers the gateway holds broker
 * credentials for, since only those are routable.
 */
export function indexModelsByRequestId(

View on GitHub (pinned to 9690622007)

Solutions

1. Verify auth.broker.url / auth.broker.token (or OMP_AUTH_BROKER_URL/TOKEN env vars) are correct.
2. Confirm the broker is reachable: curl its snapshot endpoint with the token and inspect the status.
3. Restart the gateway with corrected credentials after a token rotation.
4. If 5xx, check broker logs/service health and retry.

if (!process.env.OMP_AUTH_BROKER_URL && !config.auth?.broker?.url) throw new Error("broker not configured");

function isSnapshotOk(r: { status: number; snapshot?: Snapshot }): r is { status: 200; snapshot: Snapshot } {
  return r.status === 200 && !!r.snapshot;
}

try {
  const snapshot = await fetchBrokerSnapshot(client);
} catch (err) {
  logger.warn("broker snapshot failed, retrying", { err });
  await Bun.sleep(backoffMs);
  return fetchBrokerSnapshot(client);
}

When it happens

Trigger: `omp auth-gateway serve` boot or catalog refresh when the broker returns non-200 (bad token, wrong URL, broker outage).

Common situations: Gateway started with a stale OMP_AUTH_BROKER_TOKEN after token rotation; broker URL pointing at the gateway itself or a wrong port; broker temporarily down while gateway refreshes its catalog.

Related errors

• Auth broker returned no snapshot
• Auth broker response failed schema validation
• AuthBrokerStreamUnsupportedError
• Auth broker returned malformed JSON
• DuckDuckGo HTML error (${page.status})

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/6efab3792463a2b2. Report an issue: GitHub.