sipeed/picoclaw · warning

generating state: %w

Error message

generating state: %w

What it means

GenerateState() failed at pkg/auth/oauth.go:99 — the 32-byte crypto/rand read backing the OAuth state parameter returned an error. Like the PKCE failure, this is an OS entropy source failure, not an application bug; on healthy systems the probability is effectively zero.

Source

Thrown at pkg/auth/oauth.go:99

	if _, err := rand.Read(buf); err != nil {
		return "", err
	}
	return hex.EncodeToString(buf), nil
}

func LoginBrowser(cfg OAuthProviderConfig) (*AuthCredential, error) {
	return LoginBrowserWithOptions(cfg, LoginBrowserOptions{})
}

func LoginBrowserWithOptions(cfg OAuthProviderConfig, opts LoginBrowserOptions) (*AuthCredential, error) {
	pkce, err := GeneratePKCE()
	if err != nil {
		return nil, fmt.Errorf("generating PKCE: %w", err)
	}

	state, err := GenerateState()
	if err != nil {
		return nil, fmt.Errorf("generating state: %w", err)
	}

	redirectURI := oauthCallbackRedirectURI(cfg.Port)
	callbackPort := cfg.Port
	var resultCh <-chan callbackResult

	if !opts.NoBrowser {
		callbackResultCh := make(chan callbackResult, 1)
		listener, actualPort, err := listenOAuthCallback(cfg.Port)
		if err != nil {
			return nil, fmt.Errorf("starting callback server on port %d: %w", cfg.Port, err)
		}

		redirectURI = oauthCallbackRedirectURI(actualPort)
		callbackPort = actualPort
		resultCh = callbackResultCh

		server := &http.Server{Handler: oauthCallbackHandler(state, callbackResultCh)}

View on GitHub (pinned to 49183d7e8d)

Solutions

1. Confirm the runtime provides a working random device: head -c 32 /dev/urandom && echo ok
2. Adjust the sandbox profile to permit getrandom(2)
3. Restart the process once; persistent failure means the environment is broken, not the app

if _, err := auth.LoginBrowser(cfg); err != nil {
    if strings.Contains(err.Error(), "generating state") {
        log.Fatal("OS random source unavailable; fix the runtime environment")
    }
    return err
}

When it happens

Trigger: Same class as PKCE: getrandom(2) blocked by seccomp, /dev/urandom absent from the container image, or entropy pool unavailable during very early boot in minimal VMs.

Common situations: Hardened containers, custom VM images, or instrumented test environments with a stubbed failing rand.Reader.

Related errors

• generating PKCE: %w
• error fetching models: %w
• parsing device code response: %w
• device code authentication timed out after 15 minutes
• reading device token response: %w

AI-assisted analysis of sipeed/picoclaw@49183d7e8d (2026-08-15). Data as JSON: /api/errors/e80440444efd7019. Report an issue: GitHub.