{"record":{"id":"caf5fa22518608de","repo":"ruvnet/ruflo","slug":"could-not-reach-the-cognitum-auth-service-ruflo-c","errorCode":null,"errorMessage":"Could not reach the Cognitum auth service. ruflo core functionality is unaffected — sign-in is not required for local use.","messagePattern":"Could not reach the Cognitum auth service\\. ruflo core functionality is unaffected — sign-in is not required for local use\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"v3/@claude-flow/cli/src/auth/client.ts","lineNumber":216,"sourceCode":"  };\n  return { tokens, method: 'token-stdin' };\n}\n\n/**\n * Refreshes an access token. Classifies failure into network-unreachable\n * vs. a reachable-but-erroring server so callers can print an honest\n * message instead of collapsing both into \"offline\" (ADR-308 failure\n * policy: local ruflo functionality is never affected by auth being\n * unavailable, but the diagnostic should say WHY it's unavailable).\n */\nexport async function refreshAccessToken(refreshTokenValue: string): Promise<OAuthTokenResponse> {\n  const sec = await loadSecurityOAuth();\n  try {\n    return await sec.refreshToken(refreshTokenValue);\n  } catch (e) {\n    if (e instanceof sec.OAuthError) {\n      if (e.code === 'network') {\n        throw new Error(\n          'Could not reach the Cognitum auth service. ruflo core functionality is unaffected — ' +\n            'sign-in is not required for local use.',\n        );\n      }\n      throw new Error(`Cognitum auth service returned an unexpected response: ${e.message}`);\n    }\n    throw e;\n  }\n}\n\n/**\n * Returns an access token suitable for an authenticated call.\n *\n * Fast path: a process-memory token with more than one minute remaining.\n * Slow path: load the profile's refresh token from the OS keychain, perform\n * one refresh, persist a rotated refresh token BEFORE exposing the new access\n * token, then update metadata and the process cache. Refresh is deliberately\n * demand-driven: offline-safe commands such as plain `auth status` never call","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/auth/client.ts#L198-L234","documentation":"Thrown by refreshAccessToken when the OAuth layer reports a network failure (DNS, connection refused, timeout). Per ADR-308, local ruflo functionality is unaffected — only authenticated remote calls fail, and the message says why.","triggerScenarios":"Calling getValidAccessToken (which performs a refresh) while offline, behind a blocking firewall, or with the auth hostname unresolvable.","commonSituations":"Air-gapped machine; corporate proxy blocking the auth host; transient ISP outage; wrong DNS.","solutions":["Check connectivity to the Cognitum auth host (curl/https).","Configure HTTP(S) proxy env vars if behind a corporate proxy.","Use offline-safe commands until connectivity is restored."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// best-effort reachability preflight\nawait fetch('https://auth.cognitum.example/health', {\n  signal: AbortSignal.timeout(3000),\n}).catch(() => {\n  throw new Error('auth host unreachable; proceeding offline');\n});","typeGuard":"function isNetworkUnreachable(e: unknown): boolean {\n  return e instanceof Error && /Could not reach the Cognitum auth service/.test(e.message);\n}","tryCatchPattern":"try {\n  return await refreshAccessToken(rt);\n} catch (e) {\n  if (isNetworkUnreachable(e)) {\n    // degrade gracefully: skip remote calls, keep local functionality\n  }\n  throw e;\n}","preventionTips":["Keep refresh demand-driven; do not refresh on a timer.","Separate offline-safe commands from authenticated ones.","Honor HTTP(S)_PROXY env vars in corporate environments."],"tags":["oauth","network","offline","auth"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}