{"record":{"id":"01617ef08f932a74","repo":"earendil-works/pi","slug":"untrusted-verification-uri-in-device-code-response","errorCode":null,"errorMessage":"Untrusted verification_uri in device code response","messagePattern":"Untrusted verification_uri in device code response","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/ai/src/auth/oauth/github-copilot.ts","lineNumber":248,"sourceCode":"\tconst expiresIn = (data as Record<string, unknown>).expires_in;\n\n\tif (\n\t\ttypeof deviceCode !== \"string\" ||\n\t\ttypeof userCode !== \"string\" ||\n\t\ttypeof verificationUri !== \"string\" ||\n\t\t(interval !== undefined && typeof interval !== \"number\") ||\n\t\ttypeof expiresIn !== \"number\"\n\t) {\n\t\tthrow new Error(\"Invalid device code response fields\");\n\t}\n\n\t// The verification URI is opened in the user's browser and to prevent `open` from\n\t// opening an executable or similar, we force it to be a URL.\n\tlet parsedUri: URL;\n\ttry {\n\t\tparsedUri = new URL(verificationUri);\n\t} catch {\n\t\tthrow new Error(\"Untrusted verification_uri in device code response\");\n\t}\n\tif (parsedUri.protocol !== \"https:\" && parsedUri.protocol !== \"http:\") {\n\t\tthrow new Error(\"Untrusted verification_uri in device code response\");\n\t}\n\n\treturn {\n\t\tdevice_code: deviceCode,\n\t\tuser_code: userCode,\n\t\tverification_uri: parsedUri.href,\n\t\tinterval,\n\t\texpires_in: expiresIn,\n\t};\n}\n\nasync function pollForGitHubAccessToken(\n\tdomain: string,\n\tdevice: DeviceCodeResponse,\n\tsignal: AbortSignal,","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/earendil-works/pi/blob/4af9d21d3b4d664e4a29fcabfec85171077248e3/packages/ai/src/auth/oauth/github-copilot.ts#L230-L266","documentation":"Error \"Untrusted verification_uri in device code response\" thrown in earendil-works/pi.","triggerScenarios":"Thrown at packages/ai/src/auth/oauth/github-copilot.ts:248 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Do not proceed; the verification_uri is untrusted, so check for a MITM or misconfigured proxy."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4af9d21d3b4d664e4a29fcabfec85171077248e3","analyzedAt":"2026-08-24T13:07:14.692Z","schemaVersion":2},"datasetVersion":"2026-08-24T17:17:21.512Z"}