eyaltoledano/claude-task-master · error · AuthenticationError

INTERNAL_ERROR

INTERNAL_ERROR

Error message

Keypair not generated before starting flow

What it means

startBackendFlow requires the RSA keypair to have been generated before contacting the backend, because the public key must be sent for E2E encryption. If this internal preconditions fails, it throws AuthenticationError with code INTERNAL_ERROR. It is a private method, so this indicates an internal sequencing bug rather than user error.

Source

Thrown at packages/tm-core/src/modules/auth/services/oauth-service.ts:257

		// Check if MFA is required
		await this.checkAndThrowIfMFARequired();

		// Notify success
		if (onSuccess) {
			onSuccess(credentials);
		}

		return credentials;
	}

	/**
	 * Start a new authentication flow on the backend
	 */
	private async startBackendFlow(): Promise<StartFlowResponse> {
		const startUrl = `${this.baseUrl}/api/auth/cli/start`;

		if (!this.keyPair) {
			throw new AuthenticationError(
				'Keypair not generated before starting flow',
				'INTERNAL_ERROR'
			);
		}

		try {
			const response = await fetch(startUrl, {
				method: 'POST',
				headers: {
					'Content-Type': 'application/json',
					'User-Agent': `TaskMasterCLI/${this.getCliVersion()}`
				},
				body: JSON.stringify({
					name: 'Task Master CLI',
					version: this.getCliVersion(),
					device: os.hostname(),
					user: os.userInfo().username,
					platform: os.platform(),

View on GitHub (pinned to c0c98d367c)

Solutions

1. Report/fix the internal bug: ensure generateKeypair() runs before startBackendFlow in the auth flow
2. Update to the latest package version in case this was a sequencing regression
3. If extending OAuthService, call the standard authenticateWithBackendPKCE entry point instead of private methods

Example fix

// before
// internal: startBackendFlow() called before keygen
await this.startBackendFlow();
await this.generateKeypair();
// after
await this.generateKeypair(); // must precede flow start
await this.startBackendFlow();

// N/A for users — internal invariant; do not invoke private flow methods directly
// always enter auth via: oauthService.authenticate()

function isInternalAuthError(e: unknown): e is AuthenticationError {
  return e instanceof AuthenticationError && e.code === 'INTERNAL_ERROR';
}

try {
  await auth.authenticate();
} catch (e) {
  if (isInternalAuthError(e)) {
    console.error('Internal auth error — please report this bug with logs:', e.message);
  } else throw e;
}

When it happens

Trigger: startBackendFlow invoked without a prior successful keyPair generation step in authenticateWithBackendPKCE — e.g. refactored call ordering, keygen silently skipped, or a subclass overriding the flow incorrectly.

Common situations: Appears after library upgrades that changed internal auth sequencing; custom code calling into oauth-service internals; keypair generation previously throwing and being swallowed upstream.

Related errors

• PKCE_INIT_FAILED
• INVALID_RESPONSE
• PKCE_FAILED
• CODE_EXCHANGE_FAILED
• No refresh token received from server - session refresh will

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/8521df6cbd408cfa. Report an issue: GitHub.