paperclipai/paperclip · error · Error

No auth user has an instance-admin role and active company m

Error message

No auth user has an instance-admin role and active company membership for local-trusted worktree seeding.

What it means

The other branch of the same seed-validation throw, used for local-trusted seeding: the query found no auth user with the instance-admin role and an active company membership at all (credential-account filters not applied). The seed needs at least one acting administrator with a membership to stamp into the seeded copy's expectation. Optional expected admin id and required company filters can also exclude every candidate.

Source

Thrown at cli/src/commands/worktree.ts:1621

          eq(companyMemberships.principalType, "user"),
          eq(companyMemberships.principalId, authUsers.id),
          eq(companyMemberships.status, "active"),
        ),
      )
      .where(and(
        expected ? eq(authUsers.id, expected.adminUserId) : undefined,
        requiredCompanyId ? eq(companyMemberships.companyId, requiredCompanyId) : undefined,
        requiresCredentialAccount
          ? and(
              sql`length(trim(${authAccounts.providerId})) > 0`,
              sql`length(trim(${authAccounts.accountId})) > 0`,
            )
          : undefined,
      ))
      .limit(1)
      .then((rows) => rows[0] ?? null);
    if (!admin) {
      throw new Error(
        requiresCredentialAccount
          ? "No auth user has a non-empty credential account, instance-admin role, and active company membership. Authenticated worktree seeding requires a credential-backed instance administrator."
          : "No auth user has an instance-admin role and active company membership for local-trusted worktree seeding.",
      );
    }

    const representative = await db
      .select({ companyId: companies.id, issueId: issues.id })
      .from(companies)
      .innerJoin(issues, eq(issues.companyId, companies.id))
      .where(
        and(
          expected ? eq(companies.id, expected.representativeCompanyId) : undefined,
          expected ? eq(issues.id, expected.representativeIssueId) : undefined,
          requiredCompanyId ? eq(companies.id, requiredCompanyId) : undefined,
        ),
      )
      .limit(1)

View on GitHub (pinned to a7e689b3c3)

Solutions

Onboard the source instance (create the admin user and an active company membership), then retry the seed
Remove or refresh the stale seed expectation (expected adminUserId) so validation is not pinned to a deleted user
If the source is genuinely empty, seed the source itself first or choose a healthy source instance

Defensive patterns

Strategy: validation

Validate before calling

-- pre-check before local-trusted seeding
SELECT 1
FROM auth_users u
JOIN company_memberships m ON m.user_id = u.id AND m.status = 'active'
WHERE u.role = 'instance-admin'
LIMIT 1; -- zero rows = seed will fail

Try / catch

Catch and surface 'onboard the source instance first (create an admin with an active membership)' as the remediation.

Prevention

Finish onboarding on the source instance before using it as a seed origin
Re-derive stale seed expectations instead of pinning deleted admin user ids

When it happens

Trigger: ensureWorktreeSeeded's validation with requiresCredentialAccount=false against a source DB with no instance-admin + active-membership row — e.g. a brand-new instance that never finished onboarding, or stale expected admin/company ids.

Common situations: Seeding from a fresh instance before onboarding created the CEO/admin user; memberships deactivated; expected ids from an old manifest pointing at deleted users.

Related errors

AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-21). Data as JSON: /api/errors/ccb0755e6ad5f258. Report an issue: GitHub.