{"record":{"id":"8d4aae772eb1348f","repo":"eyaltoledano/claude-task-master","slug":"pkce-failed","errorCode":"PKCE_FAILED","errorMessage":"Failed to start PKCE flow: ${(error as Error).message}","messagePattern":"Failed to start PKCE flow: (.+?)","errorType":"error_code","errorClass":"AuthenticationError","httpStatus":null,"severity":"error","filePath":"packages/tm-core/src/modules/integration/clients/supabase-client.ts","lineNumber":174,"sourceCode":"\t\t\tif (!data?.url) {\n\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t'No authorization URL returned',\n\t\t\t\t\t'INVALID_RESPONSE'\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Extract code_verifier from the URL or generate it\n\t\t\t// Note: Supabase handles PKCE internally, we just need to handle the callback\n\t\t\treturn {\n\t\t\t\turl: data.url,\n\t\t\t\tcodeVerifier: '' // Supabase manages this internally\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tif (error instanceof AuthenticationError) {\n\t\t\t\tthrow error;\n\t\t\t}\n\n\t\t\tthrow new AuthenticationError(\n\t\t\t\t`Failed to start PKCE flow: ${(error as Error).message}`,\n\t\t\t\t'PKCE_FAILED'\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Exchange authorization code for session (PKCE flow)\n\t */\n\tasync exchangeCodeForSession(code: string): Promise<Session> {\n\t\tconst client = this.getClient();\n\n\t\ttry {\n\t\t\tconst { data, error } = await client.auth.exchangeCodeForSession(code);\n\n\t\t\tif (error) {\n\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t`Failed to exchange code: ${error.message}`,","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/eyaltoledano/claude-task-master/blob/c0c98d367c55296bfe69e65680625b6db437af02/packages/tm-core/src/modules/integration/clients/supabase-client.ts#L156-L192","documentation":"signInWithPKCE wraps any non-AuthenticationError thrown during the flow (network failures, storage errors, unexpected exceptions) in an AuthenticationError with code PKCE_FAILED, preserving the original error message.","triggerScenarios":"Any exception inside signInWithPKCE other than the Supabase-returned errors already handled: network timeouts fetching the authorization URL, errors generating/extracting the code_verifier, storage adapter failures.","commonSituations":"Offline machine or DNS failure, firewall blocking api.supabase.co, keychain/storage backend unavailable when persisting PKCE state.","solutions":["Check network connectivity to the Supabase project","Retry the sign-in once connectivity is restored","Inspect the embedded message for the underlying cause (e.g. fetch failed, storage error)"],"exampleFix":"null","handlingStrategy":"retry","validationCode":"null","typeGuard":"null","tryCatchPattern":"try {\n  await client.signInWithPKCE();\n} catch (e) {\n  if (e instanceof AuthenticationError && e.code === 'PKCE_FAILED' && isTransient(e.message)) {\n    await client.signInWithPKCE(); // one retry for network blips\n  }\n}","preventionTips":["Check connectivity before starting the auth flow","Ensure the storage adapter (keychain/file) is writable","Distinguish transient network errors from config errors before retrying"],"tags":["auth","pkce","network","supabase"],"backgroundTag":"oauth-flow-init-failed","analyzedSha":"c0c98d367c55296bfe69e65680625b6db437af02","analyzedAt":"2026-08-29T02:56:26.071Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}