{"record":{"id":"0e01dbc421d2b3a1","repo":"eyaltoledano/claude-task-master","slug":"refresh-failed-0e01db","errorCode":"REFRESH_FAILED","errorMessage":"Failed to refresh session: ${(error as Error).message}","messagePattern":"Failed to refresh session: (.+?)","errorType":"error_code","errorClass":"AuthenticationError","httpStatus":null,"severity":"error","filePath":"packages/tm-core/src/modules/integration/clients/supabase-client.ts","lineNumber":288,"sourceCode":"\t\t\t\tthrow toAuthenticationError(error, 'Failed to refresh session');\n\t\t\t}\n\n\t\t\tif (session) {\n\t\t\t\tthis.logger.info('Successfully refreshed session');\n\t\t\t}\n\n\t\t\treturn session;\n\t\t} catch (error) {\n\t\t\tif (error instanceof AuthenticationError) {\n\t\t\t\tthrow error;\n\t\t\t}\n\n\t\t\t// Handle raw Supabase auth errors that might be thrown\n\t\t\tif (isSupabaseAuthError(error)) {\n\t\t\t\tthrow toAuthenticationError(error, 'Session refresh failed');\n\t\t\t}\n\n\t\t\tthrow new AuthenticationError(\n\t\t\t\t`Failed to refresh session: ${(error as Error).message}`,\n\t\t\t\t'REFRESH_FAILED'\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Get current user from session\n\t */\n\tasync getUser(): Promise<User | null> {\n\t\tconst client = this.getClient();\n\n\t\ttry {\n\t\t\tconst {\n\t\t\t\tdata: { user },\n\t\t\t\terror\n\t\t\t} = await client.auth.getUser();\n","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/eyaltoledano/claude-task-master/blob/c0c98d367c55296bfe69e65680625b6db437af02/packages/tm-core/src/modules/integration/clients/supabase-client.ts#L270-L306","documentation":"SupabaseClient.refreshSession() wraps any unexpected failure from `supabase.auth.refreshSession()` in an AuthenticationError with code REFRESH_FAILED. Known Supabase auth errors are already converted by toAuthenticationError/isSupabaseAuthError, so this generic wrapper only fires when the refresh fails for a non-auth reason (network failure, unexpected exception, malformed client state). It means the stored refresh token could not be exchanged for a new session.","triggerScenarios":"Calling refreshSession() when client.auth.refreshSession() throws an exception that is neither an AuthenticationError nor a Supabase AuthApiError — e.g. fetch/network failure, storage adapter throwing while reading the refresh token, or a programming error inside the Supabase client.","commonSituations":"Offline or behind a corporate proxy blocking supabase.co; expired/revoked refresh token paired with a thrown (not error-returned) response; custom storage adapter crashing on read; clock-skew or DNS failures in CI containers.","solutions":["Check network connectivity / proxy rules so the machine can reach the Supabase project URL.","Call getSession() first; if it returns null the session is gone — re-authenticate via login instead of refreshing.","Sign out and clear the session storage, then perform a fresh login to obtain a new refresh token.","Inspect the wrapped message for the underlying cause (storage adapter, fetch error) and fix that root cause."],"exampleFix":"// before\nconst session = await client.refreshSession();\n// after\ntry {\n  const session = await client.refreshSession();\n} catch (e) {\n  if (e instanceof AuthenticationError && e.code === 'REFRESH_FAILED') {\n    await client.signOut();\n    // restart interactive login flow\n  }\n}","handlingStrategy":"try-catch","validationCode":"// guard: only refresh when a session actually exists\nconst current = await client.getSession();\nif (!current) {\n  // no session to refresh — go straight to login\n}","typeGuard":"function hasAuthErrorCode(e: unknown, code: string): e is AuthenticationError {\n  return e instanceof AuthenticationError && e.code === code;\n}","tryCatchPattern":"try {\n  const session = await client.refreshSession();\n} catch (e) {\n  if (e instanceof AuthenticationError && e.code === 'REFRESH_FAILED') {\n    await client.signOut();\n    // fall back to interactive login\n  } else throw e;\n}","preventionTips":["Check session existence with getSession() before refreshing.","Keep refresh cadence well inside the refresh-token lifetime.","Always implement a sign-out-and-relogin fallback for refresh failures.","Monitor connectivity/proxy configuration in CI environments."],"tags":["auth","session","network","supabase"],"backgroundTag":"refresh-token-invalid","analyzedSha":"c0c98d367c55296bfe69e65680625b6db437af02","analyzedAt":"2026-08-29T02:56:26.071Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}