{"record":{"id":"833abddbad01133e","repo":"ruvnet/ruflo","slug":"token-stdin-json-is-missing-required-field-acc","errorCode":null,"errorMessage":"--token-stdin: JSON is missing required field \"access_token\"","messagePattern":"--token-stdin: JSON is missing required field \"access_token\"","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/auth/client.ts","lineNumber":191,"sourceCode":" * `{access_token, refresh_token?, expires_in, scope}`. Wire format is not\n * specified by ADR-306 — defined here as typed JSON rather than a bare\n * token string, so scope/expiry are explicit rather than inferred.\n */\nexport async function tokenStdinLogin(input: NodeJS.ReadableStream = process.stdin): Promise<LoginResult> {\n  const chunks: Buffer[] = [];\n  for await (const chunk of input) chunks.push(chunk as Buffer);\n  const raw = Buffer.concat(chunks).toString('utf-8').trim();\n  if (!raw) throw new Error('--token-stdin: no input received on stdin');\n\n  let parsed: { access_token?: string; refresh_token?: string; expires_in?: number; scope?: string };\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\n      '--token-stdin expects a single JSON object: {\"access_token\",\"refresh_token\"?,\"expires_in\",\"scope\"}',\n    );\n  }\n  if (!parsed.access_token) throw new Error('--token-stdin: JSON is missing required field \"access_token\"');\n\n  const tokens: OAuthTokenResponse = {\n    access_token: parsed.access_token,\n    token_type: 'Bearer',\n    refresh_token: parsed.refresh_token,\n    expires_in: parsed.expires_in,\n  };\n  return { tokens, method: 'token-stdin' };\n}\n\n/**\n * Refreshes an access token. Classifies failure into network-unreachable\n * vs. a reachable-but-erroring server so callers can print an honest\n * message instead of collapsing both into \"offline\" (ADR-308 failure\n * policy: local ruflo functionality is never affected by auth being\n * unavailable, but the diagnostic should say WHY it's unavailable).\n */\nexport async function refreshAccessToken(refreshTokenValue: string): Promise<OAuthTokenResponse> {","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/auth/client.ts#L173-L209","documentation":"Thrown by tokenStdinLogin when the parsed JSON object lacks the required access_token field. Other fields (refresh_token, expires_in, scope) are tolerated, but access_token is mandatory.","triggerScenarios":"Piping JSON like {\"token\":\"...\"} (wrong field name) or a refresh-only object that has no access_token key.","commonSituations":"Producer used a different field name; refresh-token object mistaken for an access-token object; partial copy-paste.","solutions":["Ensure the JSON includes access_token as a non-empty string.","If you only hold a refresh token, use the interactive/manual PKCE flow or keychain profile, not --token-stdin."],"exampleFix":"// before\n{ \"refresh_token\": \"...\" }\n\n// after\n{ \"access_token\": \"...\", \"refresh_token\": \"...\", \"expires_in\": 3600 }","handlingStrategy":"type-guard","validationCode":"if (typeof parsed.access_token !== 'string' || parsed.access_token.length === 0) {\n  throw new Error('JSON is missing a non-empty string field \"access_token\"');\n}","typeGuard":"function hasAccessToken(v: unknown): v is { access_token: string } {\n  return !!v && typeof v === 'object' && typeof (v as { access_token?: unknown }).access_token === 'string' && (v as { access_token: string }).access_token.length > 0;\n}","tryCatchPattern":null,"preventionTips":["Validate required keys immediately after parse, before constructing the token.","Adopt a schema (e.g. zod) for the token wire format.","Reject empty-string access tokens, not just missing ones."],"tags":["oauth","token-stdin","validation","auth"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}