earendil-works/pi · error · Error

Untrusted verification_uri in device code response

Error message

Untrusted verification_uri in device code response

What it means

Error "Untrusted verification_uri in device code response" thrown in earendil-works/pi.

Source

Thrown at packages/ai/src/auth/oauth/github-copilot.ts:248

	const expiresIn = (data as Record<string, unknown>).expires_in;

	if (
		typeof deviceCode !== "string" ||
		typeof userCode !== "string" ||
		typeof verificationUri !== "string" ||
		(interval !== undefined && typeof interval !== "number") ||
		typeof expiresIn !== "number"
	) {
		throw new Error("Invalid device code response fields");
	}

	// The verification URI is opened in the user's browser and to prevent `open` from
	// opening an executable or similar, we force it to be a URL.
	let parsedUri: URL;
	try {
		parsedUri = new URL(verificationUri);
	} catch {
		throw new Error("Untrusted verification_uri in device code response");
	}
	if (parsedUri.protocol !== "https:" && parsedUri.protocol !== "http:") {
		throw new Error("Untrusted verification_uri in device code response");
	}

	return {
		device_code: deviceCode,
		user_code: userCode,
		verification_uri: parsedUri.href,
		interval,
		expires_in: expiresIn,
	};
}

async function pollForGitHubAccessToken(
	domain: string,
	device: DeviceCodeResponse,
	signal: AbortSignal,

View on GitHub (pinned to 4af9d21d3b)

Solutions

1. Do not proceed; the verification_uri is untrusted, so check for a MITM or misconfigured proxy.

When it happens

Trigger: Thrown at packages/ai/src/auth/oauth/github-copilot.ts:248 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of earendil-works/pi@4af9d21d3b (2026-08-24). Data as JSON: /api/errors/01617ef08f932a74. Report an issue: GitHub.