can1357/oh-my-pi · error

Auth broker returned no snapshot

Error message

Auth broker returned no snapshot

What it means

The `omp auth-broker migrate` command builds a migration plan from the broker's current credential snapshot. After calling AuthBrokerClient.fetchSnapshot(), it requires HTTP status 200; anything else means the broker did not return usable snapshot data, so a plain Error is thrown rather than proceeding with an empty/partial snapshot. This guards against silently migrating from an empty catalog.

Source

Thrown at packages/coding-agent/src/cli/auth-broker-cli.ts:772

	return false;
}

async function runMigrate(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
	const brokerConfig = await resolveAuthBrokerConfig();
	if (!brokerConfig) {
		throw new Error(
			"OMP_AUTH_BROKER_URL must be set (or `auth.broker.url` in config.yml). `migrate` uploads local credentials to a configured broker.",
		);
	}
	if (flags.fromLocal !== true) {
		throw new Error(
			"`omp auth-broker migrate` requires an explicit source. Pass `--from-local` to migrate from the local SQLite store and env vars.",
		);
	}

	const client = new AuthBrokerClient({ url: brokerConfig.url, token: brokerConfig.token });
	const snapshotResult = await client.fetchSnapshot();
	if (snapshotResult.status !== 200) throw new Error("Auth broker returned no snapshot");
	const existing = indexBrokerSnapshot(snapshotResult.snapshot);

	const plan: MigratePlanEntry[] = [];
	const skipped: MigrateSkip[] = [];

	// 1. Local SQLite rows.
	const localDbPath = getAgentDbPath();
	const localStore = await SqliteAuthCredentialStore.open(localDbPath);
	const plannedApiKeyProviders = new Set<string>();
	try {
		for (const row of localStore.listAuthCredentials()) {
			// Skip placeholder sentinels that pi-ai treats as "authenticated via
			// out-of-band mechanism" (Bedrock/Vertex `<authenticated>`). They
			// aren't real keys and uploading them would store garbage on the
			// broker. Mirrors the env-var path's guard below.
			if (row.credential.type === "api_key" && row.credential.key === "<authenticated>") {
				skipped.push({
					source: "local-sqlite",

View on GitHub (pinned to 9690622007)

Solutions

1. Check `omp auth-broker` connectivity: verify OMP_AUTH_BROKER_URL (or auth.broker.url/token in config.yml) points at a live broker.
2. Verify the broker token is valid and not expired/rotated — a 401 is the most common non-200.
3. Curl the broker's snapshot endpoint manually with the same URL and bearer token to see the actual status/body.
4. Retry once the broker service is healthy if it returned 5xx.

const cfg = await resolveAuthBrokerConfig();
if (!cfg) throw new Error("Broker URL/token not configured");
// optionally: const res = await fetch(cfg.url + "/snapshot", { headers: { Authorization: `Bearer ${cfg.token}` } });
// if (!res.ok) fail fast with res.status

function hasSnapshot(r: { status: number; snapshot?: unknown }): r is { status: 200; snapshot: unknown } {
  return r.status === 200 && r.snapshot !== undefined;
}

try {
  const snap = await client.fetchSnapshot();
  if (snap.status !== 200) throw new Error(`broker snapshot HTTP ${snap.status}`);
} catch (err) {
  logger.error("auth-broker snapshot unavailable", { err });
  process.exitCode = 1;
}

When it happens

Trigger: Running `omp auth-broker migrate` when the broker responds with a non-200 status (e.g. 401 invalid token, 404 wrong URL path, 5xx broker failure, network proxy error).

Common situations: Misconfigured OMP_AUTH_BROKER_URL or auth.broker.url in config.yml; expired/rotated auth.broker.token; broker service down or upgraded behind a reverse proxy returning error pages.

Related errors

• Auth broker returned no initial snapshot
• Auth broker response failed schema validation
• AuthBrokerStreamUnsupportedError
• Auth broker returned malformed JSON
• DuckDuckGo HTML error (${page.status})

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/13072bee262a8215. Report an issue: GitHub.