multica-ai/multica · error

failed to generate state: %w

Error message

failed to generate state: %w

What it means

Browser login generates a 16-byte random state parameter for CSRF protection via crypto/rand. This error wraps a rand.Read failure, which on Go's modern userspace CSPRNG essentially never happens unless the OS entropy source is unavailable at very early boot or in a broken sandbox.

Source

Thrown at server/cmd/multica/cmd_auth.go:261

	callbackHost, bindAddr := resolveCallbackBinding(flagHost, serverURL, appURL, detectOutboundIP)

	// Pin to "tcp4" — a bare "tcp" on macOS can produce an IPv6-only socket
	// that IPv4 clients (including browsers resolving localhost → 127.0.0.1)
	// cannot reach. The callback URL is always an IPv4 literal or hostname,
	// so an IPv4 listener is what the browser actually needs.
	listener, err := net.Listen("tcp4", bindAddr+":0")
	if err != nil {
		return fmt.Errorf("could not start the local login callback server (used to receive the browser sign-in); a firewall or another process may be blocking local ports: %w", err)
	}
	defer listener.Close()

	port := listener.Addr().(*net.TCPAddr).Port
	callbackURL := fmt.Sprintf("http://%s:%d/callback", callbackHost, port)

	// Generate a random state parameter for CSRF protection.
	stateBytes := make([]byte, 16)
	if _, err := rand.Read(stateBytes); err != nil {
		return fmt.Errorf("failed to generate state: %w", err)
	}
	state := hex.EncodeToString(stateBytes)

	loginURL := fmt.Sprintf("%s/login?cli_callback=%s&cli_state=%s", appURL, url.QueryEscape(callbackURL), url.QueryEscape(state))

	// Channel to receive the JWT from the browser callback.
	jwtCh := make(chan string, 1)
	errCh := make(chan error, 1)

	mux := http.NewServeMux()
	mux.HandleFunc("/callback", func(w http.ResponseWriter, r *http.Request) {
		token := r.URL.Query().Get("token")
		if token == "" {
			http.Error(w, "missing token", http.StatusBadRequest)
			return
		}
		returnedState := r.URL.Query().Get("state")
		if returnedState != state {

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Retry the login command — entropy usually becomes available immediately
2. If in a restricted container, allow the getrandom syscall / /dev/urandom access
3. Fall back to token login: `multica login --token <PAT>`

# entropy is effectively always transient: single retry
multica login || { sleep 2; multica login; }

When it happens

Trigger: Extremely early boot before the kernel CSPRNG is seeded; a seccomp/sandbox profile blocking the getrandom syscall; pathological VM/container setups where entropy device access is denied.

Common situations: Minimal VMs or scratch containers with restricted syscalls; almost never seen on normal workstations and servers.

Related errors

• could not start the local login callback server (used to rec
• local server error: %w
• timed out waiting for authentication
• failed to save config: %w
• no input

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/b2b60c7293c7d9fd. Report an issue: GitHub.