{"record":{"id":"7b61b1b2bb4d8a3e","repo":"paperclipai/paperclip","slug":"no-auth-user-has-a-non-empty-credential-account-i","errorCode":null,"errorMessage":"No auth user has a non-empty credential account, instance-admin role, and active company membership. Authenticated worktree seeding requires a credential-backed instance administrator.","messagePattern":"No auth user has a non-empty credential account, instance-admin role, and active company membership\\. Authenticated worktree seeding requires a credential-backed instance administrator\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/src/commands/worktree.ts","lineNumber":1621,"sourceCode":"          eq(companyMemberships.principalType, \"user\"),\n          eq(companyMemberships.principalId, authUsers.id),\n          eq(companyMemberships.status, \"active\"),\n        ),\n      )\n      .where(and(\n        expected ? eq(authUsers.id, expected.adminUserId) : undefined,\n        requiredCompanyId ? eq(companyMemberships.companyId, requiredCompanyId) : undefined,\n        requiresCredentialAccount\n          ? and(\n              sql`length(trim(${authAccounts.providerId})) > 0`,\n              sql`length(trim(${authAccounts.accountId})) > 0`,\n            )\n          : undefined,\n      ))\n      .limit(1)\n      .then((rows) => rows[0] ?? null);\n    if (!admin) {\n      throw new Error(\n        requiresCredentialAccount\n          ? \"No auth user has a non-empty credential account, instance-admin role, and active company membership. Authenticated worktree seeding requires a credential-backed instance administrator.\"\n          : \"No auth user has an instance-admin role and active company membership for local-trusted worktree seeding.\",\n      );\n    }\n\n    const representative = await db\n      .select({ companyId: companies.id, issueId: issues.id })\n      .from(companies)\n      .innerJoin(issues, eq(issues.companyId, companies.id))\n      .where(\n        and(\n          expected ? eq(companies.id, expected.representativeCompanyId) : undefined,\n          expected ? eq(issues.id, expected.representativeIssueId) : undefined,\n          requiredCompanyId ? eq(companies.id, requiredCompanyId) : undefined,\n        ),\n      )\n      .limit(1)","sourceCodeStart":1603,"sourceCodeEnd":1639,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/cli/src/commands/worktree.ts#L1603-L1639","documentation":"During authenticated worktree seed validation, a single query selects one auth user that simultaneously has a credential-backed account (non-empty trimmed authAccounts.providerId and accountId), the instance-admin role, and an active company membership (with optional expected.adminUserId / requiredCompanyId filters). requiresCredentialAccount is true for authenticated seed modes, which need a credential-bearing admin to represent post-seed. No matching row means the source database cannot back an authenticated seeded copy.","triggerScenarios":"ensureWorktreeSeeded's validation with requiresCredentialAccount=true against a source DB where every instance admin lacks an OAuth credential account, or where the expected admin user id / required company id filters exclude the only candidate.","commonSituations":"Source instance set up in local-trusted mode that never completed an OAuth login; credential account rows wiped or blanked; seeding authenticated worktrees from a dev instance whose users are all passwordless.","solutions":["Complete an interactive (OAuth) login on the source instance so a credential account exists for an instance admin, then retry the seed","Seed in local-trusted mode instead if the target does not need authenticated seeding","Verify expected.adminUserId and requiredCompanyId still exist and point at a credential-backed admin"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"-- pre-check before authenticated seeding\nSELECT 1\nFROM auth_users u\nJOIN auth_accounts a ON a.user_id = u.id\nJOIN company_memberships m ON m.user_id = u.id AND m.status = 'active'\nWHERE u.role = 'instance-admin'\n  AND length(trim(a.provider_id)) > 0\n  AND length(trim(a.account_id)) > 0\nLIMIT 1; -- zero rows = seed will fail","typeGuard":null,"tryCatchPattern":"Catch and either fall back to local-trusted seeding or surface 'complete an OAuth login as an instance admin on the source' as the remediation.","preventionTips":["Have at least one instance admin complete an interactive (OAuth) login on the source before seeding authenticated worktrees","Keep the seed expectation's adminUserId pointing at a credential-backed admin"],"tags":["auth","worktree","seed","admin","database"],"backgroundTag":"missing-admin-user","analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-21T17:58:32.592Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}