paperclipai/paperclip · error · GitHubAttachmentUnavailableError

github_attachment_canonical_authority_unavailable

github_attachment_canonical_authority_unavailable

Error message

github_attachment_canonical_authority_unavailable

What it means

resolveGitHubAttachmentComment performs a canonical GitHub API request using the installation-scoped GitHub App authority captured during inbound admission. It throws GitHubAttachmentUnavailableError('github_attachment_canonical_authority_unavailable') when the runtime has no githubAttachmentAppAuthority, i.e. the installation credential needed to act with App authority is absent.

Source

Thrown at server/src/services/chat-sdk-runtime.ts:2835

  /** Only attachments reconstructed by this runtime can use the batch budget. */
  async fetchTeamsInlineImage(
    attachment: Attachment,
    signal: AbortSignal,
  ): Promise<Buffer> {
    const fetcher = this.teamsInlineImageFetchers.get(attachment);
    if (!fetcher || signal.aborted)
      throw new Error("Teams inline image download unavailable");
    return await fetcher(signal);
  }

  /** Called only after current inbound admission; installation App authority only. */
  async resolveGitHubAttachmentComment(
    request: GitHubAttachmentCommentRequest,
    signal: AbortSignal,
  ): Promise<unknown> {
    if (!this.githubAttachmentAppAuthority)
      throw new GitHubAttachmentUnavailableError(
        "github_attachment_canonical_authority_unavailable",
      );
    if (!isGitHubAttachmentCommentRequest(request))
      throw new GitHubAttachmentUnavailableError(
        "github_attachment_source_mismatch",
      );
    try {
      signal.throwIfAborted();
      const result = await (this.adapter as GitHubAdapter).octokit.request(
        `GET ${request.url}`,
        {
          headers: {
            accept: request.accept,
            "x-github-api-version": "2022-11-28",
          },
          request: {
            signal,
            redirect: "manual",

View on GitHub (pinned to 01ad858492)

Solutions

1. Ensure the runtime is constructed with githubAttachmentAppAuthority from the GitHub App installation during inbound admission
2. Verify the GitHub App installation is still active and its token can be minted for the target repository
3. Re-admit the message so a fresh authority is captured, then retry attachment resolution
4. Route the call through the GitHub runtime that owns the admission, not an arbitrary runtime

Example fix

// before
const data = await runtime.resolveGitHubAttachmentComment(request, signal);
// after
if (runtime.hasGitHubAttachmentAuthority()) {
  const data = await runtime.resolveGitHubAttachmentComment(request, signal);
}

if (!runtime.hasGitHubAttachmentAuthority()) throw new Error('GitHub attachment authority not provisioned');

const hasAuthority = (r: ChatSdkRuntime) => r.githubAttachmentAppAuthority != null;

try { return await runtime.resolveGitHubAttachmentComment(request, signal); } catch (e) { if ((e as Error).message === 'github_attachment_canonical_authority_unavailable') { /* re-admit message to capture authority */ } else throw e; }

When it happens

Trigger: Calling resolveGitHubAttachmentComment on a runtime constructed without the GitHub attachment App authority (missing GitHub App installation credential for the repo), typically because admission never captured it or the runtime was built outside the GitHub inbound path.

Common situations: GitHub App uninstalled or installation token not refreshed; runtime reconstructed (e.g. after restart) without the attachment authority; attachment resolution invoked from a non-GitHub endpoint's runtime.

Related errors

• github_attachment_canonical_html_unavailable
• github_attachment_canonical_file_unsupported
• github_attachment_canonical_image_count_invalid
• github_attachment_canonical_target_denied
• github_attachment_canonical_mapping_ambiguous

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/7b6a47227e23e94c. Report an issue: GitHub.