{"record":{"id":"65fe7a7078ea5430","repo":"ruvnet/ruflo","slug":"token-stdin-expects-a-single-json-object-acce","errorCode":null,"errorMessage":"--token-stdin expects a single JSON object: {\"access_token\",\"refresh_token\"?,\"expires_in\",\"scope\"}","messagePattern":"--token-stdin expects a single JSON object: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/auth/client.ts","lineNumber":187,"sourceCode":"}\n\n/**\n * `--token-stdin`: reads one JSON object from stdin,\n * `{access_token, refresh_token?, expires_in, scope}`. Wire format is not\n * specified by ADR-306 — defined here as typed JSON rather than a bare\n * token string, so scope/expiry are explicit rather than inferred.\n */\nexport async function tokenStdinLogin(input: NodeJS.ReadableStream = process.stdin): Promise<LoginResult> {\n  const chunks: Buffer[] = [];\n  for await (const chunk of input) chunks.push(chunk as Buffer);\n  const raw = Buffer.concat(chunks).toString('utf-8').trim();\n  if (!raw) throw new Error('--token-stdin: no input received on stdin');\n\n  let parsed: { access_token?: string; refresh_token?: string; expires_in?: number; scope?: string };\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\n      '--token-stdin expects a single JSON object: {\"access_token\",\"refresh_token\"?,\"expires_in\",\"scope\"}',\n    );\n  }\n  if (!parsed.access_token) throw new Error('--token-stdin: JSON is missing required field \"access_token\"');\n\n  const tokens: OAuthTokenResponse = {\n    access_token: parsed.access_token,\n    token_type: 'Bearer',\n    refresh_token: parsed.refresh_token,\n    expires_in: parsed.expires_in,\n  };\n  return { tokens, method: 'token-stdin' };\n}\n\n/**\n * Refreshes an access token. Classifies failure into network-unreachable\n * vs. a reachable-but-erroring server so callers can print an honest\n * message instead of collapsing both into \"offline\" (ADR-308 failure","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/auth/client.ts#L169-L205","documentation":"Thrown by tokenStdinLogin when stdin had content but it was not valid JSON. --token-stdin requires a single JSON object, not a bare token string or other text.","triggerScenarios":"Piping a bare access token string, a raw JWT, YAML, or any non-JSON text to --token-stdin.","commonSituations":"User assumed --token-stdin takes a bare token; producer emitted a different format than the JSON wire shape.","solutions":["Wrap the token as JSON: {\"access_token\":\"...\",\"expires_in\":3600,\"scope\":\"...\"}.","Validate that the producer emits the documented JSON wire format."],"exampleFix":"# before\necho \"$ACCESS_TOKEN\" | ruflo auth login --token-stdin\n\n# after\njq -n --arg t \"$ACCESS_TOKEN\" '{access_token:$t,expires_in:3600,scope:\"default\"}' | ruflo auth login --token-stdin","handlingStrategy":"validation","validationCode":"let parsed: unknown;\ntry {\n  parsed = JSON.parse(raw);\n} catch {\n  throw new Error('stdin is not JSON; wrap as {\"access_token\":...,\"expires_in\":...,\"scope\":...}');\n}","typeGuard":"function isTokenObject(v: unknown): v is { access_token: string } {\n  return !!v && typeof v === 'object' && typeof (v as { access_token?: unknown }).access_token === 'string';\n}","tryCatchPattern":null,"preventionTips":["Document and enforce the JSON wire format at the CLI boundary.","Reject bare strings explicitly with a helpful message.","Provide a sample JSON in --help."],"tags":["oauth","token-stdin","json","auth"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}