stablyai/orca · error

Artifact authentication overrides are available only in deve

Error message

Artifact authentication overrides are available only in development builds.

What it means

Thrown by withAuth() when options.authToken is supplied but allowsArtifactCloudAuthOverride() returns false. The override gate is `NODE_ENV !== 'production' && !isPackaged()` — i.e. it is only permitted in unpackaged development builds. Auth-token overrides exist for local testing of cloud auth and are intentionally blocked in shipped/packaged or production-NODE_ENV builds.

Source

Thrown at src/main/artifacts/artifact-cloud-service.ts:285

      this.publisher.runForSlug(id, auth, async () => {
        auth.assertCurrent()
        await deleteArtifactRequest(apiUrl, token, `/${encodeURIComponent(id)}`)
        auth.assertCurrent()
        removeArtifactShareRecords(auth.profileId, this.userDataPath, auth.scope, { slug: id })
      })
    )
  }

  private async withAuth<T>(
    options: ArtifactCloudOptions,
    operation: (token: string, apiUrl: string, auth: ArtifactAuthContext) => Promise<T>
  ): Promise<ArtifactCloudOperation<T>> {
    const apiUrl = resolveArtifactCloudApiUrl(options.apiUrl)
    const active = ensureActiveOrcaProfile(this.userDataPath)
    prepareArtifactCloudUse(active.profile, this.userDataPath)
    if (options.authToken?.trim()) {
      if (!allowsArtifactCloudAuthOverride()) {
        throw new Error(
          'Artifact authentication overrides are available only in development builds.'
        )
      }
      const token = options.authToken.trim()
      const auth = explicitTokenAuthContext(active, apiUrl, token, this.userDataPath)
      const value = await operation(token, apiUrl, auth)
      auth.assertCurrent()
      return {
        status: 'ok',
        value
      }
    }
    const config = getOrcaCloudAuthConfig()
    if (!config.configured) {
      return { status: 'unconfigured', message: config.setupMessage }
    }
    const result = await runWithFreshOrcaCloudSession(
      config.config,

View on GitHub (pinned to 1136503c6a)

Solutions

1. Stop passing options.authToken in non-dev contexts — let the service use stored-session auth instead.
2. If you genuinely need the override, run from an unpackaged dev build with NODE_ENV unset or not 'production'.
3. Audit the call site that forwards authToken and gate it behind an is-dev check so it never reaches production builds.

Example fix

// before
await service.share({ sourceKey, authToken: devToken, ... }) // packaged build -> throws

// after
const opts = process.env.NODE_ENV !== 'production' && !isPackaged()
  ? { sourceKey, authToken: devToken, ... }
  : { sourceKey, ... } // rely on stored session in prod
await service.share(opts)

import { allowsArtifactCloudAuthOverride } from '...'

function safeOptions(opts: ArtifactCloudOptions): ArtifactCloudOptions {
  if (!allowsArtifactCloudAuthOverride() && opts.authToken?.trim()) {
    // authToken only works in unpackaged dev; drop it in prod to use stored session
    const { authToken, ...rest } = opts
    return rest
  }
  return opts
}

await service.share(safeOptions(request))

function isDevAuthOverrideAllowed(): boolean {
  return process.env.NODE_ENV !== 'production' && !isPackagedProcess()
}

function isPackagedProcess(): boolean {
  // mirror isPackaged() semantics for your runtime
  return Boolean(process.execPath.match(/\.app\/|\.exe$/))
}

null

When it happens

Trigger: Passing a non-empty options.authToken in a packaged app build, or with NODE_ENV=production, or in any non-dev environment. Also fires if a dev-only code path leaks an authToken into a production-configured process.

Common situations: A developer's test harness that injects authToken accidentally ships or runs against a packaged binary; NODE_ENV is set to 'production' in a staging/dev shell; an integration test forgets to clear authToken before running against a packaged build.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• authentication_required
• authentication_unconfigured
• The active Orca profile is not linked to a cloud account.
• This file has not been shared from the active Orca profile.
• Gitea request failed: HTTP ${response.status}

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/d9caf82169ab4ea6. Report an issue: GitHub.