multica-ai/multica · error

agent execution context requires MULTICA_TOKEN to be a task-

Error message

agent execution context requires MULTICA_TOKEN to be a task-scoped mat_ token

What it means

`multica auth status` detects daemon-managed agent execution (inDaemonManagedExecutionContext). In that context the credential must be a task-scoped mat_ token — the daemon deliberately provisions per-task tokens. If the resolved token has any other prefix (mul_, cloud PAT, empty-but-set env), status refuses to run to surface credential-plumbing bugs.

Source

Thrown at server/cmd/multica/cmd_auth.go:473

	if cfg.AppURL == "" && serverURL == defaultCloudServerURL {
		cfg.AppURL = defaultCloudAppURL
	}
	if err := cli.SaveCLIConfigForProfile(cfg, profile); err != nil {
		return fmt.Errorf("failed to save config: %w", err)
	}

	fmt.Fprintf(os.Stderr, "Authenticated as %s (%s)\nToken saved to config.\n", me.Name, me.Email)
	return nil
}

func runAuthStatus(cmd *cobra.Command, _ []string) error {
	if err := requireTaskLocalConfigRoot(); err != nil {
		return err
	}
	taskContext := inDaemonManagedExecutionContext()
	token := resolveToken(cmd)
	if taskContext && !strings.HasPrefix(token, "mat_") {
		return fmt.Errorf("agent execution context requires MULTICA_TOKEN to be a task-scoped mat_ token")
	}
	serverURL := resolveServerURL(cmd)

	if token == "" {
		fmt.Fprintln(os.Stderr, "Not authenticated. Run 'multica login' to authenticate.")
		return nil
	}

	client := cli.NewAPIClient(serverURL, "", token)

	ctx, cancel := cli.APIContext(context.Background())
	defer cancel()

	var me struct {
		Name  string `json:"name"`
		Email string `json:"email"`
	}
	if err := client.GetJSON(ctx, "/api/me", &me); err != nil {

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Unset the manual override: `unset MULTICA_TOKEN` and let the daemon inject the task-scoped mat_ token
2. Verify with the daemon operator/template that tasks receive mat_ tokens
3. Update daemon and CLI to matching versions if token scoping changed recently
4. To use human credentials, run the CLI outside the daemon-managed execution context

Example fix

# before (inside a chat task)
export MULTICA_TOKEN=mul_personal...
multica auth status   # -> agent execution context requires mat_

# after
unset MULTICA_TOKEN
multica auth status

# inside daemon-managed tasks, assert the token scope
case "${MULTICA_TOKEN:-}" in mat_*) ;; *) echo 'MULTICA_TOKEN must be a mat_ task token here' >&2; exit 1;; esac

When it happens

Trigger: MULTICA_TOKEN set to a human PAT (mul_...) inside an agent task; the daemon's token injection missing/overridden so a personal token leaks into the task env; manually exporting a user token while running under the daemon.

Common situations: Developers debugging inside a chat task and exporting their own credentials; misconfigured daemon templates that copy user config into task env; version skew between daemon and CLI on token scoping.

Related errors

• invalid token format: must start with %s
• failed to save config: %w
• token is required
• server URL not set: use --server-url flag, MULTICA_SERVER_UR
• daemon-managed task requires a task-local Multica config roo

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/9bee6e9e6e967386. Report an issue: GitHub.