Code review: flowstate Blank token file is treated as a valid cached token

[ajbeaver]

Generated by Offband issue reporting.

Summary

Code review: flowstate Blank token file is treated as a valid cached token

Routing

• Repo: offband/FlowState
• Repo class: public_tool
• Rule id: code_review.error_handling
• Candidate key: code-review:flowstate:auth-error
• Category: code-review
• Severity: warning
• Review profile: code_review
• Review target: flowstate
• Labels: offband-report, weekly, needs-owner, code-review
• Source: code_review.bounded_ai

Expected

Product repositories should avoid actionable code risks identified by bounded source review.

Observed

src/flowstate_runtime/auth.py:14: When the token file exists, ensure_token() returns path.read_text(...).strip() even if the file is empty or whitespace-only.

Why It Matters

A truncated or accidentally blank token file causes read_token()/flow auth token to return an empty token instead of regenerating or reporting a clear recovery error, leaving the runtime unable to authenticate clients.

Decision Needed

Treat empty token file contents as invalid and regenerate or raise an actionable error.

Policy Source

config/issue-reporting.json: code_review

Evidence

{
  "artifact_path": "<redacted-path>",
  "canonical_topic": "auth-error",
  "dedupe_core": "ensure-token",
  "dedupe_subject": "symbol:ensure-token",
  "finding": {
    "confidence": "high",
    "finding_class": "error_handling",
    "impact": "A truncated or accidentally blank token file causes `read_token()`/`flow auth token` to return an empty token instead of regenerating or reporting a clear recovery error, leaving the runtime unable to authenticate clients.",
    "line": 14,
    "owner_decision": "Treat empty token file contents as invalid and regenerate or raise an actionable error.",
    "path": "src/flowstate_runtime/auth.py",
    "summary": "When the token file exists, `ensure_token()` returns `path.read_text(...).strip()` even if the file is empty or whitespace-only.",
    "title": "Blank token file is treated as a valid cached token"
  },
  "line": 14,
  "path": "src/flowstate_runtime/auth.py",
  "semantic_topic": "auth-error"
}

Suggested Resolution

Treat empty token file contents as invalid and regenerate or raise an actionable error.

Report

• Report generated: 2026-06-21T12:20:30Z
• Candidate key: code-review:flowstate:auth-error

[ajbeaver]

Fixed in 8810329. Blank runtime token files are now treated as invalid and regenerated, with test coverage.