zeroclaw-labs/zeroclaw · warning · anyhow::Error

No OAuth code provided

Error message

No OAuth code provided

What it means

parse_code_from_redirect takes the pasted redirect URL (or bare code) and first trims it; an empty (or whitespace-only) input bails here before any URL/query parsing or state checking. It is the input-validation gate for `auth paste-redirect` and the loopback receiver, so it means nothing was pasted, not that the paste was malformed.

Source

Thrown at crates/zeroclaw-providers/src/auth/openai_oauth.rs:296

    let code = parse_code_from_redirect(path, Some(expected_state))?;

    let body =
        "<html><body><h2>ZeroClaw login complete</h2><p>You can close this tab.</p></body></html>";
    let response = format!(
        "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
        body.len(),
        body
    );
    let _ = stream.write_all(response.as_bytes()).await;

    Ok(code)
}

pub fn parse_code_from_redirect(input: &str, expected_state: Option<&str>) -> Result<String> {
    let trimmed = input.trim();
    if trimmed.is_empty() {
        anyhow::bail!("No OAuth code provided");
    }

    let query = if let Some((_, right)) = trimmed.split_once('?') {
        right
    } else {
        trimmed
    };

    let params = parse_query_params(query);
    let is_callback_payload = trimmed.contains('?')
        || params.contains_key("code")
        || params.contains_key("state")
        || params.contains_key("error");

    if let Some(err) = params.get("error") {
        let desc = params
            .get("error_description")
            .cloned()

View on GitHub (pinned to 88bb9c8533)

Solutions

  1. Paste the full redirect URL copied from the browser address bar after consent (or the bare code) and press Enter
  2. In automation, verify the clipboard/stdin variable is non-empty before feeding it to the command
  3. If the redirect URL is long and wraps in the terminal, paste as one line — a mangled empty paste triggers this too

Example fix

// before: feeding possibly-empty input
let code = parse_code_from_redirect(&pasted, Some(state))?;

// after: guard empty input with a clearer message
let trimmed = pasted.trim();
if trimmed.is_empty() {
    anyhow::bail!("Nothing pasted — copy the redirect URL from the browser and retry");
}
let code = parse_code_from_redirect(trimmed, Some(state))?;
Defensive patterns

Strategy: validation

Validate before calling

let trimmed = input.trim();
if trimmed.is_empty() {
    anyhow::bail!("no redirect URL pasted — copy the browser URL after consent and retry");
}
let code = openai_oauth::parse_code_from_redirect(trimmed, expected_state)?;

Type guard

fn has_redirect_payload(input: &str) -> bool {
    !input.trim().is_empty()
}

Try / catch

match openai_oauth::parse_code_from_redirect(&pasted, Some(state)) {
    Err(e) if e.to_string() == "No OAuth code provided" => {
        eprintln!("nothing was pasted — paste the full redirect URL and press Enter");
        continue; // re-prompt
    }
    other => other?,
}

Prevention

When it happens

Trigger: Calling `zeroclaw auth paste-redirect` and submitting an empty prompt/EOF (piped stdin closed early), or programmatically calling parse_code_from_redirect with an empty string in tests/wrappers.

Common situations: Piping an unset variable into the paste prompt (`zeroclaw ... | xclip` style automation), scripts reading the clipboard before it is populated, or interactive prompts exited with Ctrl-D.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/24463ae3b2fad423. Report an issue: GitHub.