ruvnet/ruflo · warning · Error

Could not reach the Cognitum auth service. ruflo core functi

Error message

Could not reach the Cognitum auth service. ruflo core functionality is unaffected — sign-in is not required for local use.

What it means

Thrown by refreshAccessToken when the OAuth layer reports a network failure (DNS, connection refused, timeout). Per ADR-308, local ruflo functionality is unaffected — only authenticated remote calls fail, and the message says why.

Source

Thrown at v3/@claude-flow/cli/src/auth/client.ts:216

  };
  return { tokens, method: 'token-stdin' };
}

/**
 * Refreshes an access token. Classifies failure into network-unreachable
 * vs. a reachable-but-erroring server so callers can print an honest
 * message instead of collapsing both into "offline" (ADR-308 failure
 * policy: local ruflo functionality is never affected by auth being
 * unavailable, but the diagnostic should say WHY it's unavailable).
 */
export async function refreshAccessToken(refreshTokenValue: string): Promise<OAuthTokenResponse> {
  const sec = await loadSecurityOAuth();
  try {
    return await sec.refreshToken(refreshTokenValue);
  } catch (e) {
    if (e instanceof sec.OAuthError) {
      if (e.code === 'network') {
        throw new Error(
          'Could not reach the Cognitum auth service. ruflo core functionality is unaffected — ' +
            'sign-in is not required for local use.',
        );
      }
      throw new Error(`Cognitum auth service returned an unexpected response: ${e.message}`);
    }
    throw e;
  }
}

/**
 * Returns an access token suitable for an authenticated call.
 *
 * Fast path: a process-memory token with more than one minute remaining.
 * Slow path: load the profile's refresh token from the OS keychain, perform
 * one refresh, persist a rotated refresh token BEFORE exposing the new access
 * token, then update metadata and the process cache. Refresh is deliberately
 * demand-driven: offline-safe commands such as plain `auth status` never call

View on GitHub (pinned to 6b01dc5a68)

Solutions

1. Check connectivity to the Cognitum auth host (curl/https).
2. Configure HTTP(S) proxy env vars if behind a corporate proxy.
3. Use offline-safe commands until connectivity is restored.

// best-effort reachability preflight
await fetch('https://auth.cognitum.example/health', {
  signal: AbortSignal.timeout(3000),
}).catch(() => {
  throw new Error('auth host unreachable; proceeding offline');
});

function isNetworkUnreachable(e: unknown): boolean {
  return e instanceof Error && /Could not reach the Cognitum auth service/.test(e.message);
}

try {
  return await refreshAccessToken(rt);
} catch (e) {
  if (isNetworkUnreachable(e)) {
    // degrade gracefully: skip remote calls, keep local functionality
  }
  throw e;
}

When it happens

Trigger: Calling getValidAccessToken (which performs a refresh) while offline, behind a blocking firewall, or with the auth hostname unresolvable.

Common situations: Air-gapped machine; corporate proxy blocking the auth host; transient ISP outage; wrong DNS.

Related errors

• Unauthorized
• MCP server "${server.name}" returned HTTP ${httpStatus}: ${h
• state mismatch — the OAuth callback did not match the reques
• login cancelled: no code was entered
• --token-stdin: no input received on stdin

AI-assisted analysis of ruvnet/ruflo@6b01dc5a68 (2026-08-12). Data as JSON: /api/errors/caf5fa22518608de. Report an issue: GitHub.