{"record":{"id":"d9caf82169ab4ea6","repo":"stablyai/orca","slug":"artifact-authentication-overrides-are-available-on","errorCode":null,"errorMessage":"Artifact authentication overrides are available only in development builds.","messagePattern":"Artifact authentication overrides are available only in development builds\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/main/artifacts/artifact-cloud-service.ts","lineNumber":285,"sourceCode":"      this.publisher.runForSlug(id, auth, async () => {\n        auth.assertCurrent()\n        await deleteArtifactRequest(apiUrl, token, `/${encodeURIComponent(id)}`)\n        auth.assertCurrent()\n        removeArtifactShareRecords(auth.profileId, this.userDataPath, auth.scope, { slug: id })\n      })\n    )\n  }\n\n  private async withAuth<T>(\n    options: ArtifactCloudOptions,\n    operation: (token: string, apiUrl: string, auth: ArtifactAuthContext) => Promise<T>\n  ): Promise<ArtifactCloudOperation<T>> {\n    const apiUrl = resolveArtifactCloudApiUrl(options.apiUrl)\n    const active = ensureActiveOrcaProfile(this.userDataPath)\n    prepareArtifactCloudUse(active.profile, this.userDataPath)\n    if (options.authToken?.trim()) {\n      if (!allowsArtifactCloudAuthOverride()) {\n        throw new Error(\n          'Artifact authentication overrides are available only in development builds.'\n        )\n      }\n      const token = options.authToken.trim()\n      const auth = explicitTokenAuthContext(active, apiUrl, token, this.userDataPath)\n      const value = await operation(token, apiUrl, auth)\n      auth.assertCurrent()\n      return {\n        status: 'ok',\n        value\n      }\n    }\n    const config = getOrcaCloudAuthConfig()\n    if (!config.configured) {\n      return { status: 'unconfigured', message: config.setupMessage }\n    }\n    const result = await runWithFreshOrcaCloudSession(\n      config.config,","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/artifacts/artifact-cloud-service.ts#L267-L303","documentation":"Thrown by withAuth() when options.authToken is supplied but allowsArtifactCloudAuthOverride() returns false. The override gate is `NODE_ENV !== 'production' && !isPackaged()` — i.e. it is only permitted in unpackaged development builds. Auth-token overrides exist for local testing of cloud auth and are intentionally blocked in shipped/packaged or production-NODE_ENV builds.","triggerScenarios":"Passing a non-empty options.authToken in a packaged app build, or with NODE_ENV=production, or in any non-dev environment. Also fires if a dev-only code path leaks an authToken into a production-configured process.","commonSituations":"A developer's test harness that injects authToken accidentally ships or runs against a packaged binary; NODE_ENV is set to 'production' in a staging/dev shell; an integration test forgets to clear authToken before running against a packaged build.","solutions":["Stop passing options.authToken in non-dev contexts — let the service use stored-session auth instead.","If you genuinely need the override, run from an unpackaged dev build with NODE_ENV unset or not 'production'.","Audit the call site that forwards authToken and gate it behind an is-dev check so it never reaches production builds."],"exampleFix":"// before\nawait service.share({ sourceKey, authToken: devToken, ... }) // packaged build -> throws\n\n// after\nconst opts = process.env.NODE_ENV !== 'production' && !isPackaged()\n  ? { sourceKey, authToken: devToken, ... }\n  : { sourceKey, ... } // rely on stored session in prod\nawait service.share(opts)","handlingStrategy":"validation","validationCode":"import { allowsArtifactCloudAuthOverride } from '...'\n\nfunction safeOptions(opts: ArtifactCloudOptions): ArtifactCloudOptions {\n  if (!allowsArtifactCloudAuthOverride() && opts.authToken?.trim()) {\n    // authToken only works in unpackaged dev; drop it in prod to use stored session\n    const { authToken, ...rest } = opts\n    return rest\n  }\n  return opts\n}\n\nawait service.share(safeOptions(request))","typeGuard":"function isDevAuthOverrideAllowed(): boolean {\n  return process.env.NODE_ENV !== 'production' && !isPackagedProcess()\n}\n\nfunction isPackagedProcess(): boolean {\n  // mirror isPackaged() semantics for your runtime\n  return Boolean(process.execPath.match(/\\.app\\/|\\.exe$/))\n}","tryCatchPattern":"null","preventionTips":["Never forward a user-supplied or test authToken into a packaged/production build.","Centralize authToken injection behind a single dev-only helper that checks allowsArtifactCloudAuthOverride().","In CI/staging, run with NODE_ENV unset (or 'development') only when you intend to test overrides."],"tags":["artifacts","cloud","auth","dev-only","configuration"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}