device-login export: refused to remove a path outside the pr

Error message

device-login export: refused to remove a path outside the proof root

What it means

Error "device-login export: refused to remove a path outside the proof root" thrown in paperclipai/paperclip.

Source

Thrown at packages/adapters/codex-local/src/server/device-login-export.ts:288

/**
 * Removes the proof home. Refuses a path outside the company-scoped proof root,
 * so a cleanup can never delete the shared, the default, or a managed home. A
 * missing proof home is a benign no-op.
 */
export async function removeProofHome(
  proofHome: string,
  input: RemoveProofHomeInput = {},
): Promise<void> {
  const env = input.env ?? process.env;
  const companyId = requireSafeSegment(
    input.companyId ?? nonEmpty(env.PAPERCLIP_COMPANY_ID) ?? "",
    "companyId",
  );
  const resolved = path.resolve(proofHome);
  const root = resolveProofHomeRoot(env, companyId);
  if (!resolved.startsWith(root + path.sep)) {
    throw new Error("device-login export: refused to remove a path outside the proof root");
  }
  await rm(resolved, { recursive: true, force: true });
}

View on GitHub (pinned to 120ae5428f)

Solutions

Keep cleanup paths inside the proof root; do not remove paths outside it.

When it happens

Trigger: Thrown at packages/adapters/codex-local/src/server/device-login-export.ts:288 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/127bf9f67961b328. Report an issue: GitHub.