tinyhumansai/openhuman · error · Error

RPC token not provided and ${tokenPath} could not be read. P

Error message

RPC token not provided and ${tokenPath} could not be read. Pass --token or set OPENHUMAN_CORE_TOKEN.

What it means

readToken() in harness-cache-audit.mjs resolves the RPC bearer as --token, then OPENHUMAN_CORE_TOKEN (seeded into opts), then <workspace>/core.token, and throws this error naming the file it could not read if all three fail. The embedded core's /rpc endpoint authenticates every call with this per-launch bearer, so the audit cannot proceed without it. Identical resolution order to goals-live.mjs's readToken, with slightly different wording.

Source

Thrown at scripts/debug/harness-cache-audit.mjs:189

    if (match?.[1]) {
      return path.join(openhumanDir, "users", match[1], "workspace");
    }
  } catch {
    // Fall back to the legacy root workspace below.
  }
  return openhumanDir;
}

async function readToken(opts) {
  if (opts.token.trim()) return opts.token.trim();
  const tokenPath = path.join(
    opts.workspace || (await defaultWorkspace()),
    "core.token",
  );
  try {
    return (await readFile(tokenPath, "utf8")).trim();
  } catch {
    throw new Error(
      `RPC token not provided and ${tokenPath} could not be read. Pass --token or set OPENHUMAN_CORE_TOKEN.`,
    );
  }
}

async function rpc(coreUrl, token, method, params, timeoutMs = 600_000) {
  const controller = new AbortController();
  const timeout = setTimeout(() => controller.abort(), timeoutMs);
  let res;
  try {
    res = await fetch(coreUrl, {
      method: "POST",
      signal: controller.signal,
      headers: {
        "content-type": "application/json",
        authorization: `Bearer ${token}`,
      },
      body: JSON.stringify({

View on GitHub (pinned to a221052e0d)

Solutions

Pass the bearer: `--token <value>` or `OPENHUMAN_CORE_TOKEN=<value>`
Align --workspace with the core's actual OPENHUMAN_WORKSPACE so <workspace>/core.token resolves
Start the app (or `openhuman-core serve`) once so core.token is written, then rerun
Use --spawn-core so the script mints and injects its own token

Example fix

# before
node scripts/debug/harness-cache-audit.mjs --core-url http://127.0.0.1:7788/rpc
# Error: RPC token not provided and .../core.token could not be read.

# after
OPENHUMAN_CORE_TOKEN=$(cat ~/.openhuman/users/<id>/workspace/core.token) \
  node scripts/debug/harness-cache-audit.mjs --core-url http://127.0.0.1:7788/rpc

Defensive patterns

Strategy: validation

Validate before calling

import { access, readFile } from "node:fs/promises";

async function bearerAvailable() {
  if ((process.env.OPENHUMAN_CORE_TOKEN || "").trim()) return true;
  const ws = process.env.OPENHUMAN_WORKSPACE || `${defaultOpenhumanDir()}/users/<id>/workspace`;
  try { await access(path.join(ws, "core.token")); return true; } catch { return false; }
}
if (!(await bearerAvailable())) {
  console.error("no bearer resolvable — pass --token, export OPENHUMAN_CORE_TOKEN, or boot the core once");
  process.exit(2);
}

Try / catch

try {
  token = await readToken(opts);
} catch (err) {
  if (/could not be read/.test(err.message)) {
    opts.spawnCore = true; // fallback: audit a self-spawned core with its own token
    ({ token } = await startCore(opts));
  } else throw err;
}

Prevention

Boot the target core once before auditing it so core.token exists on disk
Pass --workspace explicitly when multiple user workspaces exist under ~/.openhuman/users
Use --spawn-core for CI runs — it removes the token-resolution dependency entirely

When it happens

Trigger: Auditing an external core started with a custom OPENHUMAN_CORE_TOKEN that was never written to disk; --workspace (or OPENHUMAN_WORKSPACE) pointing at a directory without core.token; OPENHUMAN_APP_ENV=staging switching the default search dir to ~/.openhuman-staging while the token lives in ~/.openhuman; the desktop app never having started the core on this machine.

Common situations: Running `pnpm debug harness-cache-audit` before ever booting the app; juggling multiple user profiles under ~/.openhuman/users/<id>/workspace; core restarted so the old token is stale (file exists but value rotated — that yields 401 later, not this error; a missing file yields this one).

Related errors

AI-assisted analysis of tinyhumansai/openhuman@a221052e0d (2026-08-16). Data as JSON: /api/errors/503de7367ed9eb8c. Report an issue: GitHub.