{"record":{"id":"42e7f81f81e8228f","repo":"ruvnet/ruflo","slug":"not-logged-in-for-profile-profile-run-rufl","errorCode":null,"errorMessage":"not logged in for profile \"${profile}\" — run: ruflo auth login --profile ${profile}","messagePattern":"not logged in for profile \"(.+?)\" — run: ruflo auth login --profile (.+?)","errorType":"exception","errorClass":"NotLoggedInError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/auth/client.ts","lineNumber":239,"sourceCode":"      throw new Error(`Cognitum auth service returned an unexpected response: ${e.message}`);\n    }\n    throw e;\n  }\n}\n\n/**\n * Returns an access token suitable for an authenticated call.\n *\n * Fast path: a process-memory token with more than one minute remaining.\n * Slow path: load the profile's refresh token from the OS keychain, perform\n * one refresh, persist a rotated refresh token BEFORE exposing the new access\n * token, then update metadata and the process cache. Refresh is deliberately\n * demand-driven: offline-safe commands such as plain `auth status` never call\n * this function and therefore never create background traffic or retry loops.\n */\nexport async function getValidAccessToken(profileName = 'default'): Promise<string> {\n  const profile = getProfile(profileName);\n  if (!profile) throw new NotLoggedInError(profileName);\n\n  const scopesWithoutConsent = profile.scopes.filter((scope) => {\n    const domain = domainForScope(scope);\n    return domain !== undefined && !hasConsent(domain);\n  });\n  if (scopesWithoutConsent.length > 0) {\n    throw new ScopeConsentMismatchError(profileName, scopesWithoutConsent);\n  }\n\n  const cached = getSessionToken(profileName, ACCESS_TOKEN_REFRESH_WINDOW_MS);\n  if (cached) return cached;\n  if (!profile.keychainRef) throw new SessionOnlyExpiredError(profileName);\n\n  const sec = await loadSecurityOAuth();\n  const keychain = await sec.createKeychainAdapter();\n  const refreshTokenValue = await keychain.getSecret(KEYCHAIN_SERVICE, profile.keychainRef);\n  if (!refreshTokenValue) throw new SessionOnlyExpiredError(profileName);\n","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/auth/client.ts#L221-L257","documentation":"Thrown by getValidAccessToken (NotLoggedInError) when the named profile does not exist in the local profiles store. The user has never completed a login for that profile name.","triggerScenarios":"Calling getValidAccessToken('work') when only 'default' exists; a typo in the profile name; --profile passed to a command that requires a token.","commonSituations":"Fresh machine; wrong profile name; profile created under a different shell or OS user.","solutions":["Run `ruflo auth login --profile <name>` first.","List existing profiles via `ruflo auth status` / profile list.","Correct the typo in the profile name."],"exampleFix":"// before\nconst tok = await getValidAccessToken('prod');\n\n// after\nif (!getProfile('prod')) {\n  throw new Error('Not logged in. Run: ruflo auth login --profile prod');\n}\nconst tok = await getValidAccessToken('prod');","handlingStrategy":"validation","validationCode":"if (!getProfile(profileName)) {\n  throw new Error(`No profile \"${profileName}\". Run: ruflo auth login --profile ${profileName}`);\n}","typeGuard":"function profileExists(name: string): boolean {\n  return !!getProfile(name);\n}","tryCatchPattern":null,"preventionTips":["Gate authenticated commands on a profile check before requesting a token.","Default to 'default' and only require named profiles when configured.","List known profiles in the error message."],"tags":["oauth","profile","auth","not-logged-in"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}