command wrote more than {PROVIDER_STDOUT_CAP_BYTES} bytes to

Error message

command wrote more than {PROVIDER_STDOUT_CAP_BYTES} bytes to stdout

What it means

After a provider command completes, run_capped enforces PROVIDER_STDOUT_CAP_BYTES on captured stdout. If the command emitted more than the cap, this error is raised and no Output is returned. The cap prevents unbounded memory growth from chatty or misbehaving credential commands.

Source

Thrown at crates/codegen/xai-grok-shell/src/auth/auth_provider.rs:328

        if let Err(e) = err_res {
            tracing::debug!(error = %e, "auth provider: stderr capture failed (advisory)");
        }
        out_res.map_err(|e| anyhow::anyhow!("reading command stdout: {e}"))?;
        child
            .wait()
            .await
            .map_err(|e| anyhow::anyhow!("waiting on command: {e}"))
    };

    let status = match tokio::time::timeout(timeout, capture).await {
        Ok(res) => res?,
        Err(_elapsed) => {
            let _ = group.kill();
            anyhow::bail!("command timed out after {}s", timeout.as_secs());
        }
    };
    if out_buf.len() as u64 > PROVIDER_STDOUT_CAP_BYTES {
        anyhow::bail!("command wrote more than {PROVIDER_STDOUT_CAP_BYTES} bytes to stdout");
    }
    Ok(std::process::Output {
        status,
        stdout: out_buf,
        stderr: err_buf,
    })
}

fn resolve_program(command: &str, cwd: Option<&std::path::Path>) -> std::path::PathBuf {
    let path = std::path::Path::new(command);
    if path.is_absolute() {
        return path.to_path_buf();
    }
    if path.components().count() > 1
        && let Some(dir) = cwd
    {
        return dir.join(path);
    }

View on GitHub (pinned to bc7f02eddd)

Solutions

Silence the command's extra stdout output (redirect logs to stderr: cmd ... 1>&2)
Fix wrapper scripts so ONLY the token/JSON payload goes to stdout
Check shell init files (~/.bashrc, ~/.profile) for echo statements in non-interactive shells
Raise PROVIDER_STDOUT_CAP_BYTES only if your provider legitimately emits large payloads

Example fix

// before (wrapper.sh)
echo "debug: fetching token..."
echo "$TOKEN"
// after
echo "debug: fetching token..." 1>&2
printf '%s' "$TOKEN"

Defensive patterns

Strategy: validation

Validate before calling

// Check the helper emits only a short token payload
let probe = Command::new("provider-cred-helper").arg("--print-token").output()?;
if probe.stdout.len() > 4096 {
    eprintln!("helper stdout suspiciously large ({} bytes)", probe.stdout.len());
}

Prevention

Route all diagnostics from wrapper scripts to stderr
Test credential commands in a clean non-interactive shell (env -i)
Keep stdout strictly to the token payload contract

When it happens

Trigger: Calling mint_provider_token when the credential command writes more than PROVIDER_STDOUT_CAP_BYTES of stdout — e.g. a wrapper script that prints debug logs, banners, or dumps JSON blobs far larger than a token.

Common situations: Credential helpers that echo verbose logging to stdout instead of stderr, shell profile/RC files printing MOTD into non-interactive stdout, or a script accidentally cat-ing a large file.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/4410abcb00dcd841. Report an issue: GitHub.