{"record":{"id":"46b0c844ab59533f","repo":"affaan-m/ECC","slug":"no-browser-is-valid-only-for-ecc-ito-login-auth","errorCode":null,"errorMessage":"--no-browser is valid only for ecc ito login; auth is validation-only.","messagePattern":"--no-browser is valid only for ecc ito login; auth is validation-only\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"scripts/ito.js","lineNumber":171,"sourceCode":"      \"Itô compute has no paper or dry-run success mode. No CLI operation was invoked.\"\n    );\n  }\n\n  const jsonIndexes = args\n    .map((value, index) => (value === \"--json\" ? index : -1))\n    .filter((index) => index >= 0);\n  if (jsonIndexes.length > 1) {\n    throw new Error(\"--json may only be provided once\");\n  }\n  const withoutJson = args.filter((value) => value !== \"--json\");\n  const command = withoutJson.shift();\n  if (!SUPPORTED_COMMANDS.includes(command)) {\n    throw new Error(\n      `Unsupported Itô command \"${command || \"(missing)\"}\"; ECC permits only login, logout, auth, find, status, and evals.`\n    );\n  }\n  if (command === \"auth\" && withoutJson.includes(\"--no-browser\")) {\n    throw new Error(\"--no-browser is valid only for ecc ito login; auth is validation-only.\");\n  }\n  if (command === \"evals\") {\n    validateNodeQualificationArgs(withoutJson, environment);\n  }\n\n  return Object.freeze({\n    help: false,\n    invocationArgs: Object.freeze([\n      ...(jsonIndexes.length === 1 ? [\"--json\"] : []),\n      command,\n      ...withoutJson,\n    ]),\n  });\n}\n\nfunction resolveItoExecutable(environment = process.env) {\n  const configured = environment[EXECUTABLE_OVERRIDE]?.trim();\n  if (!configured) {","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/affaan-m/ECC/blob/01e15490f04e29cfefe3896951f43db46994d8ee/scripts/ito.js#L153-L189","documentation":"Thrown by parseArgs at scripts/ito.js:170-172 when the command is 'auth' and --no-browser is present in the remaining args. Per the help text (ito.js:45), `ecc ito auth` is validation-only and never starts device login, so a browser-suppression flag is meaningless for it. --no-browser is only valid for `ecc ito login`, which is the device-authorization flow that opens the Itô verification page by default.","triggerScenarios":"`ecc ito auth --no-browser`; `ecc ito --json auth --no-browser`. Any invocation where command === 'auth' and withoutJson.includes('--no-browser').","commonSituations":"Operator runs `ecc ito auth --no-browser` thinking auth also opens a browser; or copies the login invocation and only swaps the subcommand. Auth-only scripts sometimes blindly pass --no-browser to suppress UI on every ito subcommand.","solutions":["Drop --no-browser when running auth: `ecc ito auth` (validation-only, no browser is ever opened).","If you actually want device login without a browser handoff, use `ecc ito login --no-browser`."],"exampleFix":"// before\n$ ecc ito auth --no-browser\n// after\n$ ecc ito auth","handlingStrategy":"validation","validationCode":"function buildItoArgs(command, extra) {\n  if (command === 'auth' && extra.includes('--no-browser')) {\n    throw new Error('--no-browser is not valid for auth; use it only with login');\n  }\n  return [command, ...extra];\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat --no-browser as a login-only flag in wrapper scripts and guard at construction time.","Document the asymmetry between login (browser) and auth (validation-only) in the runbook."],"tags":["cli","validation","ito","auth","flags"],"backgroundTag":null,"analyzedSha":"01e15490f04e29cfefe3896951f43db46994d8ee","analyzedAt":"2026-08-13T00:31:08.655Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}