What causes "MFA verification cancelled" in eyaltoledano/claude-task-master?

eyaltoledano/claude-task-master · info · AuthenticationError

MFA_VERIFICATION_FAILED

MFA_VERIFICATION_FAILED

Error message

MFA verification cancelled

What it means

promptForMFACode throws an AuthenticationError with code MFA_VERIFICATION_FAILED when the user cancels the MFA code prompt (Ctrl+C / ExitPromptError / 'force closed'). It converts the prompt-library abort signal into a typed auth error so callers can distinguish user cancellation from real verification failures. The raw prompt error is intentionally not propagated.

Source

Thrown at apps/cli/src/utils/auth-ui.ts:164

					if (!/^\d{6}$/.test(trimmed)) {
						return 'MFA code must be exactly 6 digits (0-9)';
					}

					return true;
				}
			}
		]);

		return response.mfaCode.trim();
	} catch (error: any) {
		// Handle user cancellation (Ctrl+C)
		if (
			error.name === 'ExitPromptError' ||
			error.message?.includes('force closed')
		) {
			ui.displayWarning(' MFA verification cancelled by user');
			throw new AuthenticationError(
				'MFA verification cancelled',
				'MFA_VERIFICATION_FAILED'
			);
		}
		throw error;
	}
}

/**
 * Display MFA verification success
 */
export function displayMFASuccess(): void {
	console.log(chalk.green('\n✓ MFA verification successful!'));
}

/**
 * Display invalid MFA code message
 * @param remaining - Number of attempts remaining

View on GitHub (pinned to c0c98d367c)

Solutions

This is expected user cancellation: catch AuthenticationError with code MFA_VERIFICATION_FAILED and exit gracefully without retry
If it should not be cancellable, re-run the auth flow without prompting or supply credentials non-interactively
Check that the terminal environment supports interactive prompts (TTY present) when running in CI/scripts

Example fix

// before
try { await login(); } catch (e) { console.error(e); }
// after
try { await login(); } catch (e) {
  if (e instanceof AuthenticationError && e.code === 'MFA_VERIFICATION_FAILED') {
    console.log('Login cancelled by user.');
    return;
  }
  throw e;
}

Defensive patterns

Strategy: try-catch

Try / catch

try { await authenticate(); } catch (e) {
  if (e instanceof AuthenticationError && e.code === 'MFA_VERIFICATION_FAILED') {
    // treat as user cancellation: log and exit cleanly
    return;
  }
  throw e;
}

Prevention

Detect non-interactive environments (no TTY) before prompting and use token-based auth instead
Document that Ctrl+C during MFA prompt cancels login
In scripts, prefer API-key or non-interactive auth to avoid prompts entirely

When it happens

Trigger: User presses Ctrl+C (or the terminal force-closes the prompt) while the interactive MFA code prompt from @inquirer/prompts is waiting for input during CLI authentication.

Common situations: User starts CLI login, is prompted for an MFA code, and aborts with Ctrl+C; scripts killing the CLI mid-prompt; non-interactive terminals rejecting the prompt.

Related errors

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/c0b9a63a492bdbce. Report an issue: GitHub.