unslothai/unsloth · error · NativePathLeaseError

Native path grant is missing its folder identity.

Error message

Native path grant is missing its folder identity.

What it means

The grant's path_kind is "document-folder" but the payload carries no device_id/file_id identity pairs, which are mandatory for folder grants. Folder identity (st_dev, st_ino pairs) is how the backend detects that a granted directory was replaced by a different directory. _validate_current_stat() refuses to proceed without it because it could not enforce identity continuity.

Source

Thrown at studio/backend/utils/native_path_leases.py:367

        raise NativePathLeaseError("Native path is no longer accessible.") from exc
    if _stat_module.S_ISLNK(st.st_mode):
        raise NativePathLeaseError("Native path is no longer a regular file.")
    if grant.path_type == "file":
        if not _stat_module.S_ISREG(st.st_mode):
            raise NativePathLeaseError("Native path is no longer a regular file.")
    elif grant.path_type == "directory":
        if not _stat_module.S_ISDIR(st.st_mode):
            raise NativePathLeaseError("Native path is no longer a directory.")
    else:
        raise NativePathLeaseError("Native path grant has an unsupported path type.")

    if grant.size_bytes is not None and st.st_size != grant.size_bytes:
        raise NativePathLeaseError("Native path changed after it was selected.")
    current_modified_ms = int(st.st_mtime_ns // 1_000_000)
    if grant.modified_ms is not None and current_modified_ms != grant.modified_ms:
        raise NativePathLeaseError("Native path changed after it was selected.")
    if grant.path_kind == "document-folder" and not identity_options:
        raise NativePathLeaseError("Native path grant is missing its folder identity.")
    current_identity = (st.st_dev, st.st_ino)
    expected_identity = _runtime_identity(identity_options)
    if expected_identity is not None and current_identity != expected_identity:
        raise NativePathLeaseError("Native path changed after it was selected.")
    return current_identity if expected_identity is not None else None


def _consume_nonce(nonce: str, expires_at_ms: int) -> None:
    now_ms = int(time.time() * 1000)
    with _REPLAY_LOCK:
        for key, expiry in list(_USED_NONCES.items()):
            if expiry <= now_ms:
                _USED_NONCES.pop(key, None)
        if nonce in _USED_NONCES:
            raise NativePathLeaseError("Native path grant was already used.")
        _USED_NONCES[nonce] = expires_at_ms

View on GitHub (pinned to 203007d190)

Solutions

1. Decode the payload and confirm device_id/file_id are missing or empty for the document-folder grant.
2. Update the Rust signer so document-folder grants always embed the folder's (st_dev, st_ino) pairs.
3. Update backend and desktop shell together to avoid the contract mismatch.
4. Re-select the folder after the fix to mint a compliant grant.

Example fix

// before (Rust signer)
if kind == "file" { payload["device_id"] = ids; payload["file_id"] = ids2; } // folders skipped

// after
// always attach identity, including document-folder grants
payload["device_id"] = ids;
payload["file_id"] = ids2;

import base64, json

def folder_grant_has_identity(lease: str) -> bool:
    payload = json.loads(base64.urlsafe_b64decode(lease.split('.')[0] + '=='))
    if payload.get('path_kind') != 'document-folder':
        return True
    d, f = payload.get('device_id'), payload.get('file_id')
    return isinstance(d, list) and isinstance(f, list) and len(d) == len(f) and len(d) > 0

def has_folder_identity(payload: dict) -> bool:
    if payload.get('path_kind') != 'document-folder':
        return True
    d, f = payload.get('device_id'), payload.get('file_id')
    return (
        isinstance(d, list) and isinstance(f, list)
        and len(d) > 0 and len(d) == len(f)
        and all(isinstance(x, int) for x in d + f)
    )

try:
    grant = verify_native_path_lease(lease, operation='read')
except NativePathLeaseError as exc:
    if 'missing its folder identity' in str(exc):
        return respond(400, 'Desktop app update required: folder grant lacks identity; update and re-select.')
    raise

When it happens

Trigger: verify_native_path_lease() with payload['path_kind'] == 'document-folder' and _identity_options(payload) returning (): the signer omitted device_id/file_id arrays for a folder grant, or emitted empty arrays; older signer versions that only pinned identity for files.

Common situations: Signer regression dropping the identity fields for folder kinds; a signer/backend version mismatch after partial update; hand-built test payloads copied from a file grant (which may omit identity).

Related errors

• Native path grant has an unsupported path type.
• Native path grant timestamps are inconsistent.
• Native path grant issue time is invalid.
• Native path grant contains invalid characters.
• Native path contains invalid characters.

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/7cdb5883180e7c6f. Report an issue: GitHub.