xai-org/grok-build · error

{e} (stderr: {})

Error message

{e} (stderr: {})

What it means

mint_provider_token runs the provider credential command via run_capped, then parse_token_output extracts the token. If parsing fails, this error embeds the parse error plus up to 300 chars of the command's trimmed stderr, so the underlying CLI failure is visible. It is the umbrella failure for a provider that ran but produced no usable token.

Source

Thrown at crates/codegen/xai-grok-shell/src/auth/auth_provider.rs:424

        if let Some(refresh) = &prev.refresh_token {
            cmd.env("GROK_AUTH_PROVIDER_REFRESH_TOKEN", refresh);
        }
        if let Some(expires_at) = prev.expires_at {
            cmd.env("GROK_AUTH_PROVIDER_EXPIRES_AT", expires_at.to_rfc3339());
        }
    }
    xai_grok_tools::util::detach_command(&mut cmd);
    cmd.envs(xai_grok_tools::util::pager_env());
    // Scrub last so nothing above can reintroduce a first-party credential.
    scrub_first_party_credentials(&mut cmd);

    let output = run_capped(&mut cmd, std::time::Duration::from_secs(timeout_secs)).await?;

    let parsed = match parse_token_output(&output) {
        Ok(parsed) => parsed,
        Err(e) => {
            let stderr = String::from_utf8_lossy(&output.stderr);
            anyhow::bail!(
                "{e} (stderr: {})",
                crate::util::truncate(stderr.trim(), 300)
            );
        }
    };
    let expires_at = parsed
        .expires_at
        .or_else(|| config.token_ttl_secs.and_then(expiry_after_seconds))
        .or_else(|| crate::auth::parse_jwt_expiration(&parsed.access_token));
    tracing::info!(
        provider = %name,
        mark_expired,
        expires_at = ?expires_at,
        "auth provider minted token"
    );
    Ok(MintedProviderToken {
        token: parsed.access_token,
        refresh_token: parsed.refresh_token,

View on GitHub (pinned to bc7f02eddd)

Solutions

1. Read the '(stderr: ...)' portion — it contains the provider CLI's actual failure message; fix that first
2. Re-authenticate with the provider (run its login command manually)
3. Verify the provider binary/credential helper is the expected version and on PATH
4. Confirm required env vars (API keys, config paths) are set in the environment running this code

// Verify provider credentials exist before minting
if std::env::var("PROVIDER_API_KEY").is_err() {
    eprintln!("provider credentials missing; mint will fail");
}

match mint_provider_token(&mut cmd, timeout).await {
    Ok(tok) => tok,
    Err(e) => {
        // message embeds the provider CLI's stderr — surface it to the user
        eprintln!("token mint failed: {e}");
        return Err(e);
    },
}

When it happens

Trigger: Calling mint_provider_token (directly or via ensure_fresh_token / recover_rejected_token) when parse_token_output rejects the command's output — malformed JSON, empty output, or an auth CLI that printed an error message instead of a token.

Common situations: Expired or missing provider credentials, provider CLI not logged in, wrong provider binary on PATH, API key revoked, or the CLI changed its output schema after an upgrade.

Related errors

• command timed out after {}s
• command wrote more than {PROVIDER_STDOUT_CAP_BYTES} bytes to
• unknown key notation: <{notation}>
• git status failed: {}
• git worktree add failed: {}

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/30fea4ef50dce5c5. Report an issue: GitHub.