dagger/dagger · error

generate PKCE: %w

Error message

generate PKCE: %w

What it means

This error wraps any failure from generatePKCE() while building the PKCE-protected OAuth authorization URL for OpenAI Codex (ChatGPT subscription) login. PKCE generation uses crypto/rand to create a random verifier and S256 challenge, so it only fails when the system's cryptographic randomness source is unavailable. It is thrown in GenerateOpenAIOAuthURL before the auth URL is constructed.

Source

Thrown at internal/cmd/dagger/llmconfig/oauth_openai.go:37

// var (not a const) so tests can point it at a local server, mirroring the
// ConfigRoot/ConfigFile override pattern.
var openaiTokenURL = "https://auth.openai.com/oauth/token" //nolint:gosec // OAuth token endpoint URL, not a credential

// OpenAITokenResponse represents the OpenAI token endpoint response.
type OpenAITokenResponse struct {
	AccessToken  string `json:"access_token"`
	RefreshToken string `json:"refresh_token"`
	ExpiresIn    int    `json:"expires_in"`
}

// GenerateOpenAIOAuthURL generates a PKCE-protected OAuth authorization URL
// for OpenAI Codex (ChatGPT subscription).
// Returns the URL, the PKCE verifier, and the state parameter.
func GenerateOpenAIOAuthURL() (authURL, verifier, state string, err error) {
	verifier, challenge, err := generatePKCE()
	if err != nil {
		return "", "", "", fmt.Errorf("generate PKCE: %w", err)
	}

	buf := make([]byte, 16)
	if _, err := rand.Read(buf); err != nil {
		return "", "", "", fmt.Errorf("generate state: %w", err)
	}
	state = hex.EncodeToString(buf)

	params := url.Values{
		"response_type":              {"code"},
		"client_id":                  {openaiClientID},
		"redirect_uri":               {openaiRedirectURI},
		"scope":                      {openaiScopes},
		"code_challenge":             {challenge},
		"code_challenge_method":      {"S256"},
		"state":                      {state},
		"id_token_add_organizations": {"true"},
		"codex_cli_simplified_flow":  {"true"},

View on GitHub (pinned to 82ba2681db)

Solutions

1. Retry the command; rand failures are typically transient environment faults
2. Check that /dev/urandom exists and is readable (e.g. `ls -l /dev/urandom`, `cat /dev/urandom | head -c 16 | xxd`) in the container/VM
3. Remove seccomp/AppArmor rules or run the process with a profile that permits getrandom(2)
4. Update the OS or container base image; crypto/rand failing on a healthy Linux/macOS is otherwise unheard of

if _, err := rand.Read(make([]byte, 16)); err != nil { return fmt.Errorf("crypto/rand unavailable: %w", err) }

if err != nil {
  if errors.Is(err, syscall.ENOSYS) || errors.Is(err, os.ErrPermission) {
    // entropy source blocked: surface env guidance, don't blind-retry
  }
  return fmt.Errorf("generate PKCE: %w", err)
}

When it happens

Trigger: Calling GenerateOpenAIOAuthURL (via `dagger llm` / interactive setup choosing OpenAI Codex OAuth) when crypto/rand.Read inside generatePKCE returns an error.

Common situations: Nearly always an OS-level entropy/crypto problem: a sandboxed or seccomp-restricted environment blocking getrandom(2), a broken /dev/urandom in a container, or an exotic OS build with a failing RNG.

Related errors

• generate state: %w
• failed to generate OAuth URL: %w
• generate PKCE: %w
• State mismatch
• Missing authorization code

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/f6a6d991f758697f. Report an issue: GitHub.