paperclipai/paperclip · error · Error

No auth user has a non-empty credential account, instance-ad

Error message

No auth user has a non-empty credential account, instance-admin role, and active company membership. Authenticated worktree seeding requires a credential-backed instance administrator.

What it means

During authenticated worktree seed validation, a single query selects one auth user that simultaneously has a credential-backed account (non-empty trimmed authAccounts.providerId and accountId), the instance-admin role, and an active company membership (with optional expected.adminUserId / requiredCompanyId filters). requiresCredentialAccount is true for authenticated seed modes, which need a credential-bearing admin to represent post-seed. No matching row means the source database cannot back an authenticated seeded copy.

Source

Thrown at cli/src/commands/worktree.ts:1621

          eq(companyMemberships.principalType, "user"),
          eq(companyMemberships.principalId, authUsers.id),
          eq(companyMemberships.status, "active"),
        ),
      )
      .where(and(
        expected ? eq(authUsers.id, expected.adminUserId) : undefined,
        requiredCompanyId ? eq(companyMemberships.companyId, requiredCompanyId) : undefined,
        requiresCredentialAccount
          ? and(
              sql`length(trim(${authAccounts.providerId})) > 0`,
              sql`length(trim(${authAccounts.accountId})) > 0`,
            )
          : undefined,
      ))
      .limit(1)
      .then((rows) => rows[0] ?? null);
    if (!admin) {
      throw new Error(
        requiresCredentialAccount
          ? "No auth user has a non-empty credential account, instance-admin role, and active company membership. Authenticated worktree seeding requires a credential-backed instance administrator."
          : "No auth user has an instance-admin role and active company membership for local-trusted worktree seeding.",
      );
    }

    const representative = await db
      .select({ companyId: companies.id, issueId: issues.id })
      .from(companies)
      .innerJoin(issues, eq(issues.companyId, companies.id))
      .where(
        and(
          expected ? eq(companies.id, expected.representativeCompanyId) : undefined,
          expected ? eq(issues.id, expected.representativeIssueId) : undefined,
          requiredCompanyId ? eq(companies.id, requiredCompanyId) : undefined,
        ),
      )
      .limit(1)

View on GitHub (pinned to a7e689b3c3)

Solutions

  1. Complete an interactive (OAuth) login on the source instance so a credential account exists for an instance admin, then retry the seed
  2. Seed in local-trusted mode instead if the target does not need authenticated seeding
  3. Verify expected.adminUserId and requiredCompanyId still exist and point at a credential-backed admin
Defensive patterns

Strategy: validation

Validate before calling

-- pre-check before authenticated seeding
SELECT 1
FROM auth_users u
JOIN auth_accounts a ON a.user_id = u.id
JOIN company_memberships m ON m.user_id = u.id AND m.status = 'active'
WHERE u.role = 'instance-admin'
  AND length(trim(a.provider_id)) > 0
  AND length(trim(a.account_id)) > 0
LIMIT 1; -- zero rows = seed will fail

Try / catch

Catch and either fall back to local-trusted seeding or surface 'complete an OAuth login as an instance admin on the source' as the remediation.

Prevention

When it happens

Trigger: ensureWorktreeSeeded's validation with requiresCredentialAccount=true against a source DB where every instance admin lacks an OAuth credential account, or where the expected admin user id / required company id filters exclude the only candidate.

Common situations: Source instance set up in local-trusted mode that never completed an OAuth login; credential account rows wiped or blanked; seeding authenticated worktrees from a dev instance whose users are all passwordless.

Understand the failure class

Related errors

AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-21). Data as JSON: /api/errors/7b61b1b2bb4d8a3e. Report an issue: GitHub.