{"record":{"id":"ceefc5c5d01a0703","repo":"ruvnet/ruflo","slug":"cognitum-auth-service-returned-an-unexpected-respo","errorCode":null,"errorMessage":"Cognitum auth service returned an unexpected response: ${e.message}","messagePattern":"Cognitum auth service returned an unexpected response: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/auth/client.ts","lineNumber":221,"sourceCode":" * Refreshes an access token. Classifies failure into network-unreachable\n * vs. a reachable-but-erroring server so callers can print an honest\n * message instead of collapsing both into \"offline\" (ADR-308 failure\n * policy: local ruflo functionality is never affected by auth being\n * unavailable, but the diagnostic should say WHY it's unavailable).\n */\nexport async function refreshAccessToken(refreshTokenValue: string): Promise<OAuthTokenResponse> {\n  const sec = await loadSecurityOAuth();\n  try {\n    return await sec.refreshToken(refreshTokenValue);\n  } catch (e) {\n    if (e instanceof sec.OAuthError) {\n      if (e.code === 'network') {\n        throw new Error(\n          'Could not reach the Cognitum auth service. ruflo core functionality is unaffected — ' +\n            'sign-in is not required for local use.',\n        );\n      }\n      throw new Error(`Cognitum auth service returned an unexpected response: ${e.message}`);\n    }\n    throw e;\n  }\n}\n\n/**\n * Returns an access token suitable for an authenticated call.\n *\n * Fast path: a process-memory token with more than one minute remaining.\n * Slow path: load the profile's refresh token from the OS keychain, perform\n * one refresh, persist a rotated refresh token BEFORE exposing the new access\n * token, then update metadata and the process cache. Refresh is deliberately\n * demand-driven: offline-safe commands such as plain `auth status` never call\n * this function and therefore never create background traffic or retry loops.\n */\nexport async function getValidAccessToken(profileName = 'default'): Promise<string> {\n  const profile = getProfile(profileName);\n  if (!profile) throw new NotLoggedInError(profileName);","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/auth/client.ts#L203-L239","documentation":"Thrown by refreshAccessToken when the OAuth server is reachable but returns an error that is not a network failure — e.g. invalid_grant (refresh token revoked/expired/reused), a 5xx, or a malformed response body.","triggerScenarios":"The refresh token was revoked, rotated-and-reused, or expired; the server returned 500/502; the response body was malformed.","commonSituations":"Refresh token reused after rotation (Cognitum has reuse detection); long-offline machine with an expired token; auth service incident.","solutions":["Re-authenticate with `ruflo auth login` to obtain a fresh refresh token.","Check the auth service status page for incidents.","Avoid running two processes that refresh the same token concurrently."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isAuthServerError(e: unknown): boolean {\n  return e instanceof Error && /unexpected response|invalid_grant/i.test(e.message);\n}","tryCatchPattern":"try {\n  return await refreshAccessToken(rt);\n} catch (e) {\n  if (isAuthServerError(e)) {\n    // prompt the user to re-login; do not auto-retry the spent refresh token\n  }\n  throw e;\n}","preventionTips":["Commit rotated refresh tokens before use; never reuse a spent token.","Serialize refreshes per profile to avoid reuse-detection revocation.","Surface server error codes verbatim for diagnosis."],"tags":["oauth","refresh-token","auth","server-error"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}