{"record":{"id":"1650f4c48f09efd5","repo":"tinyhumansai/openhuman","slug":"rpc-token-not-provided-and-tokenpath-could-not-1650f4","errorCode":null,"errorMessage":"RPC token not provided and ${tokenPath} could not be read. Pass --token or set OPENHUMAN_CORE_TOKEN.","messagePattern":"RPC token not provided and (.+?) could not be read\\. Pass --token or set OPENHUMAN_CORE_TOKEN\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/debug/harness-subagent-rpc-audit.mjs","lineNumber":198,"sourceCode":"      \"utf8\",\n    );\n    const match = active.match(/^\\s*user_id\\s*=\\s*\"([^\"]+)\"\\s*$/m);\n    if (match?.[1]) {\n      return path.join(openhumanDir, \"users\", match[1], \"workspace\");\n    }\n  } catch {\n    // Fall through to legacy root workspace.\n  }\n  return openhumanDir;\n}\n\nasync function readToken(opts) {\n  if (opts.token.trim()) return opts.token.trim();\n  const tokenPath = path.join(opts.workspace, \"core.token\");\n  try {\n    return (await readFile(tokenPath, \"utf8\")).trim();\n  } catch {\n    throw new Error(\n      `RPC token not provided and ${tokenPath} could not be read. Pass --token or set OPENHUMAN_CORE_TOKEN.`,\n    );\n  }\n}\n\nasync function rpc(coreUrl, token, method, params, timeoutMs = 600_000) {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), timeoutMs);\n  let res;\n  try {\n    res = await fetch(coreUrl, {\n      method: \"POST\",\n      signal: controller.signal,\n      headers: {\n        \"content-type\": \"application/json\",\n        authorization: `Bearer ${token}`,\n      },\n      body: JSON.stringify({","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/a221052e0df5b1f7598fceba7329fd1af95d6699/scripts/debug/harness-subagent-rpc-audit.mjs#L180-L216","documentation":"Token resolution failure in readToken() of harness-subagent-rpc-audit. The bearer for the /rpc endpoint comes from --token (or OPENHUMAN_CORE_TOKEN) first; otherwise the script reads <workspace>/core.token — the file a standalone core writes next to its RPC server. If neither source yields a token, the audit refuses to make any call.","triggerScenarios":"Attaching to a core without --spawn-core while (a) no --token and no OPENHUMAN_CORE_TOKEN env, and (b) the resolved --workspace (or OPENHUMAN_WORKSPACE) does not contain core.token — wrong workspace path, a core that runs embedded in the desktop app (which hands the token in-memory, not via that file), or a core not yet started so the file was never written.","commonSituations":"Default workspace resolution picked ~/.openhuman root instead of the per-user workspace that actually holds core.token; running against the desktop app's embedded core; the core was started in another terminal and its workspace differs from the one passed here.","solutions":["Pass the token explicitly: `--token $(cat <real-workspace>/core.token)` or export OPENHUMAN_CORE_TOKEN","Point --workspace at the workspace the target core actually serves (check where core.token exists)","Or switch to `--spawn-core` so the harness generates and injects the token itself","If the core is not running, start it first (`./target/debug/openhuman-core serve`) so core.token appears"],"exampleFix":"# before\nnode scripts/debug/harness-subagent-rpc-audit.mjs --workspace ~/.openhuman\n\n# after\nexport OPENHUMAN_CORE_TOKEN=\"$(cat ~/.openhuman/users/<id>/workspace/core.token)\"\nnode scripts/debug/harness-subagent-rpc-audit.mjs --workspace ~/.openhuman/users/<id>/workspace","handlingStrategy":"validation","validationCode":"import { readFileSync, existsSync } from \"node:fs\";\nconst ws = process.env.OPENHUMAN_WORKSPACE ?? \"~/.openhuman\";\nconst tokenPath = `${ws}/core.token`;\nconst token = process.env.OPENHUMAN_CORE_TOKEN ?? (existsSync(tokenPath) ? readFileSync(tokenPath, \"utf8\").trim() : \"\");\nif (!token) { console.error(`no token: set OPENHUMAN_CORE_TOKEN or ensure ${tokenPath} exists`); process.exit(2); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer --spawn-core so token generation is the script's job","When attaching, resolve --workspace to the directory that actually contains core.token"],"tags":["auth","token","rpc","workspace","cli"],"backgroundTag":null,"analyzedSha":"a221052e0df5b1f7598fceba7329fd1af95d6699","analyzedAt":"2026-08-16T12:47:06.542Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}