AlistGo/alist · error

file_ids is required

Error message

file_ids is required

What it means

Returned by the Terabox jsToken bootstrap (drivers/terabox/util.go:51) when scraping the dashboard HTML for the embedded token fails: getStrBetween cannot find the literal delimiters around window.jsToken. Without jsToken most authenticated API calls cannot be signed.

Source

Thrown at drivers/123_open/other.go:151

// resolveFileID prefers an explicitly passed id and falls back to the object
// the request was addressed to.
func resolveFileID(args model.OtherArgs, explicit int64) (int64, error) {
	if explicit != 0 {
		return explicit, nil
	}
	if args.Obj != nil {
		return parseFileID(args.Obj.GetID())
	}
	return 0, errors.New("file_id is required")
}

// resolveFileIDs falls back to the addressed object when no list was given.
func resolveFileIDs(args model.OtherArgs, explicit []int64) ([]int64, error) {
	if len(explicit) > 0 {
		return explicit, nil
	}
	if args.Obj == nil {
		return nil, errors.New("file_ids is required")
	}
	id, err := parseFileID(args.Obj.GetID())
	if err != nil {
		return nil, err
	}
	return []int64{id}, nil
}

// Shared request and response shapes.
type (
	fileIDRequest struct {
		FileID int64 `json:"file_id"`
	}
	fileIDsRequest struct {
		FileIDs []int64 `json:"file_ids"`
	}
	// okResult answers the operations the platform reports nothing about.
	okResult struct {

View on GitHub (pinned to 843d9dc814)

Solutions

1. Update the driver / application to a version whose token extraction matches the current Terabox front-end.
2. Verify the cookie is fully valid (see check_login errno handling) — invalid cookies often yield a login page instead of the dashboard.
3. If an anti-bot page is returned, change egress IP or reduce request rate, then retry Init.
4. As a stopgap in a fork, patch getStrBetween delimiters to the new script signature seen in the logged HTML.

Example fix

// before
jsToken := getStrBetween(html, "`function%20fn%28a%29%7Bwindow.jsToken%20%3D%20a%7D%3Bfn%28%22`, `%22%29`") // delimiters no longer match

// after: fallback to regex against current markup
m := regexp.MustCompile(`window\.jsToken\s*=\s*"([^"]+)"`).FindStringSubmatch(html)
if m == nil {
	return fmt.Errorf("jsToken not found, html: %s", html)
}
jsToken := m[1]

// detect interstitial/anti-bot pages before token extraction
if !strings.Contains(html, "jsToken") {
	// likely login/captcha page: refresh cookie first
}

func isJsTokenErr(err error) bool {
	return err != nil && strings.Contains(err.Error(), "jsToken not found")
}

if err := d.refreshJsToken(); isJsTokenErr(err) {
	// 1) re-validate cookie, 2) update driver version, 3) retry once after rate-limit pause
}

When it happens

Trigger: Terabox ships a new front-end build that changes or removes the inline script that sets window.jsToken; the HTML returned is a captcha/verification/interstitial page instead of the dashboard (bot detection); cookie invalid so an unauthenticated page comes back; base_url serving different markup per region.

Common situations: After Terabox front-end deploys (most common cause — driver-vs-site drift); running from datacenter IPs triggering anti-bot pages; partially valid cookies; extensions or CDNs injecting markup.

Related errors

• access_token is required in token mode
• clientID and clientSecret are required in client_credentials
• 123 offline download cannot target the root directory, pick
• file_id is required
• renames is required

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/790351149fcc83ba. Report an issue: GitHub.