mastra-ai/mastra · error · Error

GitHub CLI is not authenticated. Run gh auth login, then ins

Error message

GitHub CLI is not authenticated. Run gh auth login, then install the plugin again.

What it means

After confirming `gh` exists, installGithubPlugin checks authentication with `gh auth status`. If that command fails (not logged in, expired token, bad keyring), the SDK throws this error because private/authenticated GitHub access would otherwise fail downstream.

Source

Thrown at mastracode/sdk/src/plugins/install.ts:221

    child.stdout?.on('data', options.onOutput);
    child.stderr?.on('data', options.onOutput);
  }
  await child;
}

async function assertGithubCliAvailable(githubCli: string): Promise<void> {
  try {
    await execa(githubCli, ['--version'], NON_INTERACTIVE_EXEC_OPTIONS);
  } catch {
    throw new Error('GitHub CLI is required to install GitHub plugins. Install gh and run gh auth login.');
  }
}

async function assertGithubCliAuthenticated(githubCli: string): Promise<void> {
  try {
    await execa(githubCli, ['auth', 'status'], NON_INTERACTIVE_EXEC_OPTIONS);
  } catch {
    throw new Error('GitHub CLI is not authenticated. Run gh auth login, then install the plugin again.');
  }
}

function parseGithubUrl(specifier: string): { owner: string; repo: string; repoSpec: string; ref?: string } {
  const [urlPart, ref] = specifier.split('#', 2);
  if (!urlPart) {
    throw new Error(`Invalid GitHub URL: ${specifier}`);
  }
  let url: URL;
  try {
    url = new URL(urlPart);
  } catch {
    throw new Error(`Invalid GitHub URL: ${specifier}`);
  }

  if (url.hostname !== 'github.com') {
    throw new Error('Only github.com plugin URLs are supported');
  }

View on GitHub (pinned to 75dd419e61)

Solutions

Run `gh auth login` interactively, then retry the install.
In CI, set GH_TOKEN (or GITHUB_TOKEN) to a valid token with repo read access, or run `gh auth login --with-token < token.txt`.
Check `gh auth status` output for expiry and run `gh auth refresh` if the token is stale.
Ensure the process environment/HOME gives gh access to its credentials (~/.config/gh/hosts.yml).

Example fix

// before (CI)
- run: mastra plugin install github:owner/private-plugin

// after
- run: gh auth login --with-token < ./gh-token
- run: mastra plugin install github:owner/private-plugin

Defensive patterns

Strategy: try-catch

Validate before calling

import { execFileSync } from 'node:child_process';
export function isGhAuthenticated(): boolean {
  try { execFileSync('gh', ['auth', 'status'], { stdio: 'ignore' }); return true; }
  catch { return false; }
}
if (!isGhAuthenticated()) throw new Error('Run gh auth login before installing GitHub plugins');

Try / catch

try {
  await installGithubPlugin(spec);
} catch (err) {
  if (err instanceof Error && err.message.includes('not authenticated')) {
    execSync('gh auth login', { stdio: 'inherit' }); // or set GH_TOKEN in CI
    return installGithubPlugin(spec); // retry once
  }
  throw err;
}

Prevention

Run `gh auth login` during machine setup; verify with `gh auth status`.
In CI, set GH_TOKEN as a secret and use `gh auth login --with-token`.
Refresh tokens proactively (`gh auth refresh`) before they expire.

When it happens

Trigger: Calling installGithubPlugin when `execa(githubCli, ['auth', 'status'])` exits non-zero — no logged-in account, expired OAuth token, or gh cannot read its credentials in a non-interactive environment.

Common situations: CI without GH_TOKEN configured; token expired after a password/2FA change; running under a different user/container that lacks gh's config dir (~/.config/gh); GH_TOKEN set to an invalid or under-scoped value.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/7d1d1ffe873a3c2f. Report an issue: GitHub.