eyaltoledano/claude-task-master · error · AuthenticationError

INVALID_RESPONSE

INVALID_RESPONSE

Error message

'Failed to get user information'

What it means

AuthenticationError with code INVALID_RESPONSE thrown by authenticateWithCode when supabaseClient.getUser() returns null even though a session was obtained. The one-time token produced a session but the user profile could not be fetched, so the library treats the auth response as incomplete and refuses to continue.

Source

Thrown at packages/tm-core/src/modules/auth/services/session-manager.ts:244

		await this.waitForInitialization();
		try {
			this.logger.info('Authenticating with one-time token...');

			// Verify the token and get session from Supabase
			const session = await this.supabaseClient.verifyOneTimeCode(token);

			if (!session || !session.access_token) {
				throw new AuthenticationError(
					'Failed to obtain access token from token',
					'NO_TOKEN'
				);
			}

			// Get user information
			const user = await this.supabaseClient.getUser();

			if (!user) {
				throw new AuthenticationError(
					'Failed to get user information',
					'INVALID_RESPONSE'
				);
			}

			// Check if MFA is required for this user
			const mfaCheck = await this.supabaseClient.checkMFARequired();

			if (mfaCheck.required && mfaCheck.factorId && mfaCheck.factorType) {
				// MFA is required - throw an error with the MFA challenge information
				throw new AuthenticationError(
					'MFA verification required. Please provide your authentication code.',
					'MFA_REQUIRED',
					undefined,
					{
						factorId: mfaCheck.factorId,
						factorType: mfaCheck.factorType
					}

View on GitHub (pinned to c0c98d367c)

Solutions

1. Retry the authentication once — the failure can be transient between the two Supabase calls
2. Confirm the user account still exists in the Supabase project
3. Check network connectivity and Supabase status
4. Generate a new one-time token and retry the whole flow

Example fix

// before
await sessionManager.authenticateWithCode(token);
// after: retry once on INVALID_RESPONSE
try {
  await sessionManager.authenticateWithCode(token);
} catch (e) {
  if (e instanceof AuthenticationError && e.code === 'INVALID_RESPONSE') {
    await sessionManager.authenticateWithCode(token); // one retry
  }
}

// confirm the user exists before token auth
// e.g. check the account is active in the Supabase dashboard/admin API before running CLI login

function isInvalidResponse(e: unknown): e is AuthenticationError {
  return e instanceof AuthenticationError && e.code === 'INVALID_RESPONSE';
}

try {
  await sessionManager.authenticateWithCode(token);
} catch (e) {
  if (isInvalidResponse(e)) {
    await delay(1000);
    await sessionManager.authenticateWithCode(token); // single retry
  } else throw e;
}

When it happens

Trigger: Calling authenticateWithCode(token) where the session validates but the subsequent getUser() call fails to resolve a user: deleted/soft-deleted user, auth admin API failure, session not yet propagated, or network error swallowed into a null return by the client wrapper.

Common situations: User removed from the Supabase auth project after the token was issued; Supabase service interruption between token verification and user fetch; staging token used against a project where the user doesn't exist.

Related errors

• REFRESH_FAILED
• NO_TOKEN
• CONFIG_MISSING
• PKCE_INIT_FAILED
• INVALID_RESPONSE

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/8486337463d9a35e. Report an issue: GitHub.