ruvnet/ruflo · error · NotLoggedInError

not logged in for profile "${profile}" — run: ruflo auth log

Error message

not logged in for profile "${profile}" — run: ruflo auth login --profile ${profile}

What it means

Thrown by getValidAccessToken (NotLoggedInError) when the named profile does not exist in the local profiles store. The user has never completed a login for that profile name.

Source

Thrown at v3/@claude-flow/cli/src/auth/client.ts:239

      throw new Error(`Cognitum auth service returned an unexpected response: ${e.message}`);
    }
    throw e;
  }
}

/**
 * Returns an access token suitable for an authenticated call.
 *
 * Fast path: a process-memory token with more than one minute remaining.
 * Slow path: load the profile's refresh token from the OS keychain, perform
 * one refresh, persist a rotated refresh token BEFORE exposing the new access
 * token, then update metadata and the process cache. Refresh is deliberately
 * demand-driven: offline-safe commands such as plain `auth status` never call
 * this function and therefore never create background traffic or retry loops.
 */
export async function getValidAccessToken(profileName = 'default'): Promise<string> {
  const profile = getProfile(profileName);
  if (!profile) throw new NotLoggedInError(profileName);

  const scopesWithoutConsent = profile.scopes.filter((scope) => {
    const domain = domainForScope(scope);
    return domain !== undefined && !hasConsent(domain);
  });
  if (scopesWithoutConsent.length > 0) {
    throw new ScopeConsentMismatchError(profileName, scopesWithoutConsent);
  }

  const cached = getSessionToken(profileName, ACCESS_TOKEN_REFRESH_WINDOW_MS);
  if (cached) return cached;
  if (!profile.keychainRef) throw new SessionOnlyExpiredError(profileName);

  const sec = await loadSecurityOAuth();
  const keychain = await sec.createKeychainAdapter();
  const refreshTokenValue = await keychain.getSecret(KEYCHAIN_SERVICE, profile.keychainRef);
  if (!refreshTokenValue) throw new SessionOnlyExpiredError(profileName);

View on GitHub (pinned to 6b01dc5a68)

Solutions

1. Run `ruflo auth login --profile <name>` first.
2. List existing profiles via `ruflo auth status` / profile list.
3. Correct the typo in the profile name.

Example fix

// before
const tok = await getValidAccessToken('prod');

// after
if (!getProfile('prod')) {
  throw new Error('Not logged in. Run: ruflo auth login --profile prod');
}
const tok = await getValidAccessToken('prod');

if (!getProfile(profileName)) {
  throw new Error(`No profile "${profileName}". Run: ruflo auth login --profile ${profileName}`);
}

function profileExists(name: string): boolean {
  return !!getProfile(name);
}

When it happens

Trigger: Calling getValidAccessToken('work') when only 'default' exists; a typo in the profile name; --profile passed to a command that requires a token.

Common situations: Fresh machine; wrong profile name; profile created under a different shell or OS user.

Related errors

• state mismatch — the OAuth callback did not match the reques
• login cancelled: no code was entered
• --token-stdin: no input received on stdin
• --token-stdin expects a single JSON object: {"access_token",
• --token-stdin: JSON is missing required field "access_token"

AI-assisted analysis of ruvnet/ruflo@6b01dc5a68 (2026-08-12). Data as JSON: /api/errors/42e7f81f81e8228f. Report an issue: GitHub.