{"record":{"id":"2f0b741d436e27e1","repo":"paperclipai/paperclip","slug":"device-login-promotion-the-readiness-check-did-no","errorCode":null,"errorMessage":"device-login promotion: the readiness check did not pass (${reason})","messagePattern":"device-login promotion: the readiness check did not pass \\((.+?)\\)","errorType":"exception","errorClass":"DeviceLoginReadinessError","httpStatus":null,"severity":"error","filePath":"packages/adapters/codex-local/src/server/adapter-auth-promotion.ts","lineNumber":207,"sourceCode":"/**\n * Promotes a device-login credential into the company scope. The order is fixed:\n * readiness check, credential validation, account-handle validation, Decision C,\n * Decision H, then the writes. The readiness check and the writes run while the\n * caller still holds the active claim, so a second session cannot race the same\n * slot.\n */\nexport async function promoteDeviceLoginCredential(\n  input: PromoteDeviceLoginCredentialInput,\n): Promise<PromoteDeviceLoginCredentialResult> {\n  const { authBytes, userInitiated, checkReadiness, isSoleActiveOwner, log } = input;\n  const env = input.env ?? process.env;\n  const companyId = requireSafeCompanyId(input.companyId);\n\n  // 1. Independent readiness check on the exact staged credential. A non-ready\n  //    result rejects the promotion before any validation or write.\n  const readiness = await checkReadiness(authBytes);\n  if (!readiness.ready) {\n    throw new DeviceLoginReadinessError(readiness.reason ?? \"not_ready\");\n  }\n\n  // 2. Validate the credential with the export rules. This rejects an empty, an\n  //    oversized, an API-key, a non-subscription, and a malformed payload.\n  assertUsableSubscriptionShape(authBytes);\n  const accountId = readSubscriptionAccountId(authBytes);\n  if (!accountId) {\n    // The shape gate above already guarantees a subscription identity; this guard\n    // keeps the account_id non-null for the handle conversion without a non-null\n    // cast.\n    throw new Error(\"device-login promotion: the credential has no subscription identity\");\n  }\n\n  // 2b. Convert the identity into a safe account handle. The handle names both\n  //     this account's own home directory and its company secret, so a login\n  //     whose identity cannot form one must fail before any write.\n  const accountHandle = toAccountHandle(accountId);\n  if (!accountHandle) {","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/packages/adapters/codex-local/src/server/adapter-auth-promotion.ts#L189-L225","documentation":"Error \"device-login promotion: the readiness check did not pass (${reason})\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at packages/adapters/codex-local/src/server/adapter-auth-promotion.ts:185 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the readiness predicate so it passes, then retry device-login promotion.","Inspect the predicate output to diagnose the failure reason."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}