{"record":{"id":"67538ed4a131d994","repo":"paperclipai/paperclip","slug":"github-did-not-return-a-full-commit-sha-for-repo","errorCode":null,"errorMessage":"GitHub did not return a full commit SHA for ${repo}@${ref}.","messagePattern":"GitHub did not return a full commit SHA for (.+?)@(.+?)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/src/commands/install.ts","lineNumber":164,"sourceCode":"  // corporate NAT exhaust the shared quota); honor an ambient token when present.\n  // The token travels via a curl --config file so it never appears in process args.\n  const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN;\n  if (!token) return runCommand(\"curl\", args, options);\n  const configDir = fs.mkdtempSync(path.join(os.tmpdir(), \"paperclipai-gh-\"));\n  const configFile = path.join(configDir, \"headers\");\n  try {\n    fs.writeFileSync(configFile, `header = \"Authorization: Bearer ${token}\"\\n`, { mode: 0o600 });\n    return await runCommand(\"curl\", [\"--config\", configFile, ...args], options);\n  } finally {\n    fs.rmSync(configDir, { recursive: true, force: true });\n  }\n}\n\nexport async function resolveGitHubRef(repo: string, ref: string, runCommand: CommandRunner): Promise<string> {\n  const result = await runGitHubCurl([\"--fail\", \"--silent\", \"--show-error\", \"--location\", \"--header\", \"Accept: application/vnd.github+json\", \"--header\", \"User-Agent: paperclipai-install\", `https://api.github.com/repos/${repo}/commits/${encodeURIComponent(ref)}`], runCommand, { maxBuffer: 4 * 1024 * 1024 });\n  let sha: unknown;\n  try { sha = (JSON.parse(result.stdout) as { sha?: unknown }).sha; } catch { throw new Error(`GitHub returned an invalid response while resolving ${repo}@${ref}.`); }\n  if (typeof sha !== \"string\" || !/^[0-9a-f]{40}$/i.test(sha)) throw new Error(`GitHub did not return a full commit SHA for ${repo}@${ref}.`);\n  return sha.toLowerCase();\n}\n\nfunction payloadEntrypoint(payloadPath: string): string {\n  return path.join(payloadPath, \"node_modules\", \"paperclipai\", \"dist\", \"index.js\");\n}\n\nexport async function smokePayload(payloadPath: string, expectedVersion: string, runCommand: CommandRunner): Promise<void> {\n  const entrypoint = payloadEntrypoint(payloadPath);\n  if (!fs.existsSync(entrypoint)) throw new Error(`Installed package is missing its CLI entrypoint: ${entrypoint}`);\n  const result = await runCommand(process.execPath, [entrypoint, \"--version\"], { maxBuffer: 1024 * 1024 });\n  const reportedVersion = result.stdout.trim().split(/\\s+/)[0];\n  if (reportedVersion !== expectedVersion) {\n    throw new Error(`Installed CLI smoke check reported ${reportedVersion || \"no version\"}; expected ${expectedVersion}.`);\n  }\n}\n\nexport async function installNpmPayload(","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/cli/src/commands/install.ts#L146-L182","documentation":"Integrity guard in the GitHub ref resolver: the API response parsed as JSON but its `sha` field was missing or not a full 40-character commit hash, so the install cannot be pinned to an immutable commit.","triggerScenarios":"Thrown at cli/src/commands/install.ts:164 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the ref resolves to a commit on GitHub; try a full commit SHA or a tag."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}