eyaltoledano/claude-task-master · warning

Legacy auth.json found but no valid Supabase session.

Error message

Legacy auth.json found but no valid Supabase session.

What it means

During startup, SessionManager.migrateLegacyAuth found an old auth.json (pre-Supabase credential store) but no valid Supabase session to migrate into. The legacy file is kept, the user is warned, and authentication is required again. Errors during migration are swallowed to debug level so startup continues.

Source

Thrown at packages/tm-core/src/modules/auth/services/session-manager.ts:91

	 * Migrate legacy auth.json to Supabase session
	 * Called once during SessionManager initialization
	 */
	private async migrateLegacyAuth(): Promise<void> {
		if (!fs.existsSync(this.LEGACY_AUTH_FILE)) {
			return;
		}

		try {
			// Check if we have a valid Supabase session (don't use hasValidSession to avoid circular wait)
			const session = await this.supabaseClient.getSession();
			if (session) {
				fs.unlinkSync(this.LEGACY_AUTH_FILE);
				this.logger.info('Migrated to Supabase auth, removed legacy auth.json');
				return;
			}

			// Otherwise, user needs to re-authenticate
			this.logger.warn('Legacy auth.json found but no valid Supabase session.');
			this.logger.warn('Please run: task-master auth login');
		} catch (error) {
			this.logger.debug('Error during legacy auth migration:', error);
		}
	}

	// ========== Session State ==========

	/**
	 * Check if valid Supabase session exists
	 * @returns true if a valid session exists
	 */
	async hasValidSession(): Promise<boolean> {
		await this.waitForInitialization();
		try {
			const session = await this.supabaseClient.getSession();
			return session != null;
		} catch {

View on GitHub (pinned to c0c98d367c)

Solutions

1. Run 'task-master auth login' to obtain a fresh Supabase session; the legacy file will be cleaned up afterwards.
2. Delete the stale legacy auth.json manually if login succeeded but the warning persists.
3. Check the debug log ('Error during legacy auth migration') for the underlying failure (permissions, corrupt JSON).
4. Ensure the system clock is correct if sessions are being rejected immediately after login.

Example fix

// before
$ cat ~/.taskmaster/auth.json // legacy expired token
// after
$ task-master auth login // creates Supabase session, removes auth.json

import fs from 'fs';
if (fs.existsSync(legacyAuthFile)) {
  console.warn('Legacy auth.json present. Run: task-master auth login');
}

function hasValidSupabaseSession(session) {
  return !!session && typeof session.access_token === 'string' &&
         typeof session.refresh_token === 'string' &&
         new Date(session.expires_at * 1000) > new Date();
}

try {
  await sessionManager.initialize();
} catch (err) {
  console.warn('Auth unavailable after legacy migration check. Run: task-master auth login');
}

When it happens

Trigger: Upgrading task-master from the legacy auth.json version to Supabase-backed auth while the stored legacy token is expired/invalid, the Supabase session file is missing/corrupt, or the user never ran 'task-master auth login' after upgrading.

Common situations: Version migration on a machine where the old token long expired; copying dotfiles/config between machines without the new session store; clock skew invalidating sessions; partially failed migration (unlink failed so both files linger).

Related errors

• REFRESH_FAILED
• REFRESH_FAILED
• SESSION_SET_FAILED
• Please run: task-master auth login
• No refresh token received from server - session refresh will

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/0832bf31cc6bd459. Report an issue: GitHub.