paperclipai/paperclip · error

device-login export: refused an empty auth payload

Error message

device-login export: refused an empty auth payload

What it means

Error "device-login export: refused an empty auth payload" thrown in paperclipai/paperclip.

Source

Thrown at packages/adapters/codex-local/src/server/device-login-export.ts:146

  }
  if (path.basename(resolved) === MANAGED_HOME_DIR_NAME) {
    throw new Error("device-login export: refused a managed Codex home");
  }
  const root = resolveProofHomeRoot(env, companyId);
  if (!resolved.startsWith(root + path.sep)) {
    throw new Error("device-login export: the proof home must be under the company-scoped proof root");
  }
}

/**
 * Enforces the bounded-size, subscription-only auth shape. Rejects an empty, an
 * oversized, an API-key, and a malformed payload. Never puts token bytes into the
 * error. The device-login promotion reuses this exact rule, so the export and the
 * promotion validate the same way.
 */
export function assertUsableSubscriptionShape(bytes: Buffer): void {
  if (bytes.length === 0) {
    throw new Error("device-login export: refused an empty auth payload");
  }
  if (bytes.length > MAX_AUTH_JSON_BYTES) {
    throw new Error("device-login export: refused an oversized auth payload");
  }
  const accountId = readSubscriptionAccountId(bytes);
  if (!accountId) {
    // Covers an API-key payload, a malformed payload, and an unusable payload.
    throw new Error("device-login export: refused a non-subscription auth payload");
  }
}

/**
 * Ensures one directory exists and is private (mode 0700). Uses `lstat` (not
 * `stat`), so the export never writes through a planted symlink. Fails closed
 * when the existing path is a symlink or a non-directory.
 */
async function ensurePrivateDir(dir: string): Promise<void> {
  const existing = await lstat(dir).catch((error: NodeJS.ErrnoException) => {

View on GitHub (pinned to 120ae5428f)

Solutions

1. Complete device login so a non-empty auth payload exists before export.

When it happens

Trigger: Thrown at packages/adapters/codex-local/src/server/device-login-export.ts:146 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/eba6ad9d70a3e8ac. Report an issue: GitHub.