ruvnet/RuView · error · TypeError

prompt must be a non-empty string

Error message

prompt must be a non-empty string

What it means

The require_authentication dependency (auth.py:435) raises HTTPException 401 with WWW-Authenticate: Bearer when request.state.user is None. Like error index 14 this indicates the middleware never set the user, but as a FastAPI dependency it produces a well-formed 401 response rather than an unhandled exception.

Source

Thrown at harness/homecore/src/hosts/claude-code.js:37

    '--permission-mode',
    write ? 'acceptEdits' : 'plan',
    '--allowedTools',
    write ? 'Read,Grep,Glob,Edit,Write' : 'Read,Grep,Glob',
  ];
}

export async function runClaudeCode({
  prompt,
  repoRoot,
  trustedRoot = repoRoot,
  allowWrite = false,
  confirm = false,
  command = 'claude',
  commandArgs = [],
  ...runOptions
}) {
  if (typeof prompt !== 'string' || !prompt.trim()) {
    throw new TypeError('prompt must be a non-empty string');
  }
  const root = assertTrustedHomecoreRepo(repoRoot, { trustedRoot });
  const write = allowWrite === true && confirm === true;
  const input = `${SAFETY_PREFIX}\n\nUser task:\n${prompt.trim()}`;
  return runProcess(
    command,
    [...commandArgs, ...buildClaudeCodeArgs({ write })],
    { ...runOptions, cwd: root, input },
  );
}

export default Object.freeze({
  name: 'claude-code',
  run: runClaudeCode,
  buildArgs: buildClaudeCodeArgs,
});

View on GitHub (pinned to 4685618388)

Solutions

1. Ensure the route path starts with /api/ or /ws/ so the middleware authenticates, or extend _requires_auth
2. Add AuthenticationMiddleware to the app before routes that depend on request.state.user
3. Send a valid Bearer token so the middleware populates request.state.user

Example fix

# before
@app.get('/v2/things')
async def things(user=Depends(require_authentication)): ...
# path outside /api/* -> middleware never authenticates -> 401
# after
@app.get('/api/v2/things')
async def things(user=Depends(require_authentication)): ...

def dependency_will_pass(request) -> bool:
    """require_authentication reads request.state.user set by the middleware."""
    return getattr(request.state, "user", None) is not None

def is_authenticated_request(request) -> bool:
    state = getattr(request, "state", None)
    user = getattr(state, "user", None) if state else None
    return isinstance(user, dict) and "username" in user

from fastapi import HTTPException

try:
    user = require_authentication(request)
except HTTPException as e:
    if e.status_code == 401:
        # not bad credentials: middleware never ran for this path
        return PlainTextResponse("Authentication required", status_code=401,
                                 headers={"WWW-Authenticate": "Bearer"})
    raise

When it happens

Trigger: Using Depends(require_authentication) on an endpoint while AuthenticationMiddleware is absent from the app; the request path (outside /api/ and /ws/) skipped auth so state.user was never set; calling the endpoint with credentials stripped by a proxy so middleware authenticated nothing.

Common situations: Mounting routers under non-/api prefixes (e.g. /v2/thing) where _requires_auth returns False, so even a valid Bearer header path returns no user; TestClient tests bypassing middleware; misordered middleware stack.

Related errors

• brain line ${index + 1}: exceeds 16 KiB
• brain line ${index + 1}: ${error.message}
• guidance query must contain 2..500 characters
• Authentication required
• Missing or invalid Authorization header

AI-assisted analysis of ruvnet/RuView@4685618388 (2026-08-16). Data as JSON: /api/errors/fc529eba7d0d4735. Report an issue: GitHub.