paperclipai/paperclip · error · DeviceLoginReadinessError

device-login promotion: the readiness check did not pass (${

Error message

device-login promotion: the readiness check did not pass (${reason})

What it means

Error "device-login promotion: the readiness check did not pass (${reason})" thrown in paperclipai/paperclip.

Source

Thrown at packages/adapters/codex-local/src/server/adapter-auth-promotion.ts:207

/**
 * Promotes a device-login credential into the company scope. The order is fixed:
 * readiness check, credential validation, account-handle validation, Decision C,
 * Decision H, then the writes. The readiness check and the writes run while the
 * caller still holds the active claim, so a second session cannot race the same
 * slot.
 */
export async function promoteDeviceLoginCredential(
  input: PromoteDeviceLoginCredentialInput,
): Promise<PromoteDeviceLoginCredentialResult> {
  const { authBytes, userInitiated, checkReadiness, isSoleActiveOwner, log } = input;
  const env = input.env ?? process.env;
  const companyId = requireSafeCompanyId(input.companyId);

  // 1. Independent readiness check on the exact staged credential. A non-ready
  //    result rejects the promotion before any validation or write.
  const readiness = await checkReadiness(authBytes);
  if (!readiness.ready) {
    throw new DeviceLoginReadinessError(readiness.reason ?? "not_ready");
  }

  // 2. Validate the credential with the export rules. This rejects an empty, an
  //    oversized, an API-key, a non-subscription, and a malformed payload.
  assertUsableSubscriptionShape(authBytes);
  const accountId = readSubscriptionAccountId(authBytes);
  if (!accountId) {
    // The shape gate above already guarantees a subscription identity; this guard
    // keeps the account_id non-null for the handle conversion without a non-null
    // cast.
    throw new Error("device-login promotion: the credential has no subscription identity");
  }

  // 2b. Convert the identity into a safe account handle. The handle names both
  //     this account's own home directory and its company secret, so a login
  //     whose identity cannot form one must fail before any write.
  const accountHandle = toAccountHandle(accountId);
  if (!accountHandle) {

View on GitHub (pinned to 01ad858492)

Solutions

1. Fix the readiness predicate so it passes, then retry device-login promotion.
2. Inspect the predicate output to diagnose the failure reason.

When it happens

Trigger: Thrown at packages/adapters/codex-local/src/server/adapter-auth-promotion.ts:185 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/2f0b741d436e27e1. Report an issue: GitHub.