{"record":{"id":"eba6ad9d70a3e8ac","repo":"paperclipai/paperclip","slug":"device-login-export-refused-an-empty-auth-payload","errorCode":null,"errorMessage":"device-login export: refused an empty auth payload","messagePattern":"device-login export: refused an empty auth payload","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/adapters/codex-local/src/server/device-login-export.ts","lineNumber":146,"sourceCode":"  }\n  if (path.basename(resolved) === MANAGED_HOME_DIR_NAME) {\n    throw new Error(\"device-login export: refused a managed Codex home\");\n  }\n  const root = resolveProofHomeRoot(env, companyId);\n  if (!resolved.startsWith(root + path.sep)) {\n    throw new Error(\"device-login export: the proof home must be under the company-scoped proof root\");\n  }\n}\n\n/**\n * Enforces the bounded-size, subscription-only auth shape. Rejects an empty, an\n * oversized, an API-key, and a malformed payload. Never puts token bytes into the\n * error. The device-login promotion reuses this exact rule, so the export and the\n * promotion validate the same way.\n */\nexport function assertUsableSubscriptionShape(bytes: Buffer): void {\n  if (bytes.length === 0) {\n    throw new Error(\"device-login export: refused an empty auth payload\");\n  }\n  if (bytes.length > MAX_AUTH_JSON_BYTES) {\n    throw new Error(\"device-login export: refused an oversized auth payload\");\n  }\n  const accountId = readSubscriptionAccountId(bytes);\n  if (!accountId) {\n    // Covers an API-key payload, a malformed payload, and an unusable payload.\n    throw new Error(\"device-login export: refused a non-subscription auth payload\");\n  }\n}\n\n/**\n * Ensures one directory exists and is private (mode 0700). Uses `lstat` (not\n * `stat`), so the export never writes through a planted symlink. Fails closed\n * when the existing path is a symlink or a non-directory.\n */\nasync function ensurePrivateDir(dir: string): Promise<void> {\n  const existing = await lstat(dir).catch((error: NodeJS.ErrnoException) => {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/adapters/codex-local/src/server/device-login-export.ts#L128-L164","documentation":"Error \"device-login export: refused an empty auth payload\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at packages/adapters/codex-local/src/server/device-login-export.ts:146 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Complete device login so a non-empty auth payload exists before export."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}