{"record":{"id":"5484ba7647c6dc33","repo":"paperclipai/paperclip","slug":"device-login-export-refused-an-oversized-auth-pay","errorCode":null,"errorMessage":"device-login export: refused an oversized auth payload","messagePattern":"device-login export: refused an oversized auth payload","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/adapters/codex-local/src/server/device-login-export.ts","lineNumber":149,"sourceCode":"  }\n  const root = resolveProofHomeRoot(env, companyId);\n  if (!resolved.startsWith(root + path.sep)) {\n    throw new Error(\"device-login export: the proof home must be under the company-scoped proof root\");\n  }\n}\n\n/**\n * Enforces the bounded-size, subscription-only auth shape. Rejects an empty, an\n * oversized, an API-key, and a malformed payload. Never puts token bytes into the\n * error. The device-login promotion reuses this exact rule, so the export and the\n * promotion validate the same way.\n */\nexport function assertUsableSubscriptionShape(bytes: Buffer): void {\n  if (bytes.length === 0) {\n    throw new Error(\"device-login export: refused an empty auth payload\");\n  }\n  if (bytes.length > MAX_AUTH_JSON_BYTES) {\n    throw new Error(\"device-login export: refused an oversized auth payload\");\n  }\n  const accountId = readSubscriptionAccountId(bytes);\n  if (!accountId) {\n    // Covers an API-key payload, a malformed payload, and an unusable payload.\n    throw new Error(\"device-login export: refused a non-subscription auth payload\");\n  }\n}\n\n/**\n * Ensures one directory exists and is private (mode 0700). Uses `lstat` (not\n * `stat`), so the export never writes through a planted symlink. Fails closed\n * when the existing path is a symlink or a non-directory.\n */\nasync function ensurePrivateDir(dir: string): Promise<void> {\n  const existing = await lstat(dir).catch((error: NodeJS.ErrnoException) => {\n    if (error.code === \"ENOENT\") return null;\n    throw error;\n  });","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/adapters/codex-local/src/server/device-login-export.ts#L131-L167","documentation":"Error \"device-login export: refused an oversized auth payload\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at packages/adapters/codex-local/src/server/device-login-export.ts:149 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the auth payload; it exceeded the maximum allowed size."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}