{"record":{"id":"00d6100b3a5e9b19","repo":"paperclipai/paperclip","slug":"device-login-export-refused-a-non-subscription-au","errorCode":null,"errorMessage":"device-login export: refused a non-subscription auth payload","messagePattern":"device-login export: refused a non-subscription auth payload","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/adapters/codex-local/src/server/device-login-export.ts","lineNumber":154,"sourceCode":"}\n\n/**\n * Enforces the bounded-size, subscription-only auth shape. Rejects an empty, an\n * oversized, an API-key, and a malformed payload. Never puts token bytes into the\n * error. The device-login promotion reuses this exact rule, so the export and the\n * promotion validate the same way.\n */\nexport function assertUsableSubscriptionShape(bytes: Buffer): void {\n  if (bytes.length === 0) {\n    throw new Error(\"device-login export: refused an empty auth payload\");\n  }\n  if (bytes.length > MAX_AUTH_JSON_BYTES) {\n    throw new Error(\"device-login export: refused an oversized auth payload\");\n  }\n  const accountId = readSubscriptionAccountId(bytes);\n  if (!accountId) {\n    // Covers an API-key payload, a malformed payload, and an unusable payload.\n    throw new Error(\"device-login export: refused a non-subscription auth payload\");\n  }\n}\n\n/**\n * Ensures one directory exists and is private (mode 0700). Uses `lstat` (not\n * `stat`), so the export never writes through a planted symlink. Fails closed\n * when the existing path is a symlink or a non-directory.\n */\nasync function ensurePrivateDir(dir: string): Promise<void> {\n  const existing = await lstat(dir).catch((error: NodeJS.ErrnoException) => {\n    if (error.code === \"ENOENT\") return null;\n    throw error;\n  });\n  if (existing) {\n    if (existing.isSymbolicLink() || !existing.isDirectory()) {\n      throw new Error(\"device-login export: the proof-home path is a symlink or a non-directory\");\n    }\n    await chmod(dir, PRIVATE_DIR_MODE);","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/adapters/codex-local/src/server/device-login-export.ts#L136-L172","documentation":"Error \"device-login export: refused a non-subscription auth payload\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at packages/adapters/codex-local/src/server/device-login-export.ts:154 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Sign in with a ChatGPT subscription account so the auth payload is a subscription payload."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}