What causes "auth" in jackwener/OpenCLI?

Re-run the rednote login flow to mint a fresh web_session cookie, then retry the command.

jackwener/OpenCLI · error · AuthRequiredError

auth

Error message

auth

What it means

This AuthRequiredError is thrown by verifyRednoteIdentity when the in-page probe reports kind === 'auth' with detail 'Rednote logged-in but userId missing — stale session'. Unlike error 3403, a web_session cookie exists, but the page's __INITIAL_STATE__ has no userId, meaning the session cookie is invalid/expired server-side. The library signals that re-authentication is required even though the browser appears logged in.

Source

Thrown at clis/rednote/auth.js:34

    (() => {
      const state = window.__INITIAL_STATE__;
      if (!state?.user) {
        return { kind: 'auth', detail: 'Rednote __INITIAL_STATE__.user missing' };
      }
      const loggedIn = state.user.loggedIn?._value;
      const userInfo = state.user.userInfo?._value || {};
      if (loggedIn !== true) {
        return { kind: 'auth', detail: 'Rednote loggedIn._value=' + String(loggedIn) + ' — anonymous' };
      }
      const userId = String(userInfo.userId || userInfo.user_id || '');
      const nickname = String(userInfo.nickname || userInfo.name || '');
      if (!userId) {
        return { kind: 'auth', detail: 'Rednote logged-in but userId missing — stale session' };
      }
      return { ok: true, user_id: userId, nickname };
    })()
  `);
  if (probe?.kind === 'auth') throw new AuthRequiredError('rednote.com', probe.detail);
  if (!probe?.ok) throw new CommandExecutionError(`Unexpected Rednote probe: ${JSON.stringify(probe)}`);
  return { user_id: probe.user_id, nickname: probe.nickname };
}

registerSiteAuthCommands({
  site: 'rednote',
  domain: 'rednote.com',
  loginUrl: 'https://www.rednote.com/explore',
  columns: ['user_id', 'nickname'],
  quickCheck: hasRednoteSessionCookie,
  verify: verifyRednoteIdentity,
  poll: async (page) => {
    if (!await hasRednoteSessionCookie(page)) {
      throw new AuthRequiredError('rednote.com', 'Waiting for Rednote web_session cookie');
    }
    return verifyRednoteIdentity(page);
  },
});

View on GitHub (pinned to 49907e53dc)

Solutions

Re-run the rednote login flow to mint a fresh web_session cookie, then retry the command.
Clear the old web_session cookie before logging in again so the stale value can't be reused.
If sessions keep dying quickly, check that the automation browser isn't sharing the profile with a live manual session that logs it out.
Confirm the probe's extraction (window.__INITIAL_STATE__ userId path) still matches the current rednote.com page; update if the site changed.
Catch AuthRequiredError and automate the re-login path instead of surfacing the error to end users.

Example fix

// before: assuming cookie presence means valid session
if (await hasRednoteSessionCookie(page)) return;

// after: handle stale-session auth errors by re-authenticating
try {
  await rednoteCommand(page);
} catch (e) {
  if (e instanceof AuthRequiredError) {
    await page.deleteCookies({ name: 'web_session', url: 'https://www.rednote.com' });
    await rednoteLogin(page);
    await rednoteCommand(page);
  } else throw e;
}

Defensive patterns

Strategy: try-catch

Validate before calling

const probe = await page.evaluate(`(() => {
  const userId = window.__INITIAL_STATE__?.user?.userId;
  return { hasCookieSession: !!document.cookie.match(/web_session=/), userId };
})()`);
if (probe.hasCookieSession && !probe.userId) {
  await rednoteLogin(page); // cookie exists but session is stale
}

Type guard

function hasValidRednoteSession(probe) {
  return !!probe && probe.kind === 'ok' && typeof probe.user_id === 'string' && probe.user_id.length > 0;
}

Try / catch

try {
  await rednoteCommand(page);
} catch (e) {
  if (e instanceof AuthRequiredError && /stale session/i.test(e.message)) {
    await page.deleteCookies({ name: 'web_session', url: 'https://www.rednote.com' });
    await rednoteLogin(page);
    return rednoteCommand(page);
  }
  throw e;
}

Prevention

Treat cookie presence as necessary but not sufficient — verify a page-level identity probe too.
Delete the old web_session cookie before re-login so stale values can't be reused.
Refresh sessions proactively if they expire quickly rather than waiting for commands to fail.
Don't share one browser profile between a live manual session and automation (remote logout invalidates the cookie).

When it happens

Trigger: Calling a rednote command after verifyRednoteIdentity passes the cookie check but the evaluate() probe on https://www.rednote.com/explore returns { kind: 'auth', detail: 'Rednote logged-in but userId missing — stale session' } — i.e., web_session cookie present but rejected or unrecognized by the server.

Common situations: Server-side session expiry while the cookie lingers in the browser; rednote rotating/invalding session tokens (e.g., after password change or remote logout); copying a stale cookie into an automation profile; site renaming __INITIAL_STATE__ fields so userId extraction fails and looks like a stale session.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/775631f40d762c9a. Report an issue: GitHub.