What causes "maven artifactId "${artifactId}" is not a valid token" in jackwener/OpenCLI?

Use a plain token artifactId, e.g. 'jackson-databind' — letters, digits, '_', '-', '.' only.

jackwener/OpenCLI · error · ArgumentError

maven artifactId "${artifactId}" is not a valid token

Error message

maven artifactId "${artifactId}" is not a valid token

What it means

requireCoord() validates the artifactId against the same COORD_TOKEN rule as groupId (letters/digits/._-, max 200 chars, must start with a letter or digit). This ArgumentError is thrown when the artifactId segment fails that pattern or is too long.

Source

Thrown at clis/maven/utils.js:60

    }
    const parts = raw.split(':');
    if (parts.length < 2 || parts.length > 3) {
        throw new ArgumentError(
            `maven coordinate "${value}" must be "groupId:artifactId" or "groupId:artifactId:version"`,
        );
    }
    const [groupId, artifactId, version] = parts;
    if (!groupId || !artifactId) {
        throw new ArgumentError(`maven coordinate "${value}" is missing groupId or artifactId`);
    }
    if (groupId.length > 200 || !COORD_TOKEN.test(groupId)) {
        throw new ArgumentError(
            `maven groupId "${groupId}" is not a valid token`,
            'Use letters / digits / "_-." (max 200 chars), starting with a letter or digit.',
        );
    }
    if (artifactId.length > 200 || !COORD_TOKEN.test(artifactId)) {
        throw new ArgumentError(
            `maven artifactId "${artifactId}" is not a valid token`,
            'Use letters / digits / "_-." (max 200 chars), starting with a letter or digit.',
        );
    }
    if (version != null && version.length > 200) {
        throw new ArgumentError(`maven version "${version}" is too long (max 200 chars).`);
    }
    return { groupId, artifactId, version: version ?? null };
}

export async function mavenFetch(url, label) {
    let resp;
    try {
        resp = await fetch(url, { headers: { 'user-agent': UA, accept: 'application/json' } });
    }
    catch (err) {
        throw new CommandExecutionError(
            `${label} request failed: ${err?.message ?? err}`,

View on GitHub (pinned to 49907e53dc)

Solutions

Use a plain token artifactId, e.g. 'jackson-databind' — letters, digits, '_', '-', '.' only.
Strip file extensions and path components from the artifact name.
Ensure the artifactId starts with a letter or digit.
Keep it at or under 200 characters.

Example fix

// before
requireCoord('com.google.guava:guava-33.0.0-jre.jar');
// after
requireCoord('com.google.guava:guava');

Defensive patterns

Strategy: validation

Validate before calling

const COORD_TOKEN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
function isValidArtifactId(a) {
  return typeof a === 'string' && a.length <= 200 && COORD_TOKEN.test(a);
}
if (!isValidArtifactId(artifactId)) throw new Error('invalid artifactId');

Type guard

function isArtifactIdToken(v) {
  return typeof v === 'string' && v.length <= 200 && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(v);
}

Try / catch

try {
  requireCoord(input);
} catch (err) {
  console.error(`artifactId invalid: ${err.message}`);
}

Prevention

Strip .jar extensions and paths from artifact names before use.
ArtifactId must start with a letter or digit — reject '.', '_', '-' starts early.
Validate from parsed segments, not the raw string, to catch the offending piece.
Keep whitespace out of CSV/TSV-derived inputs (trim each field).

When it happens

Trigger: Calling with an artifactId containing illegal characters (spaces, slashes, brackets), starting with '.', '_' or '-', or longer than 200 characters.

Common situations: Copy/pasting an artifact filename like 'guava-33.0.0-jre.jar' including '.jar' or path; version ranges or classifiers smuggled into the artifact segment ('a:b:1.0' typo'd as 'a:b-c:1.0' is fine, but 'a:/path' is not); whitespace from CSV/TSV input.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/7396e56afc825d33. Report an issue: GitHub.