unslothai/unsloth · error · NativePathLeaseError

Native path grant version is unsupported.

Error message

Native path grant version is unsupported.

What it means

The payload's version field is present and integer-coercible but is not 1 — the only grant schema version this backend understands. Old or future grant formats are rejected explicitly rather than mis-parsed.

Source

Thrown at studio/backend/utils/native_path_leases.py:321

    payload: dict[str, Any], *, operation: str, expected_kind: str | None
) -> None:
    required = (
        "version",
        "operation",
        "canonical_path",
        "path_kind",
        "path_type",
        "source_kind",
        "token_id_hash",
        "issued_at_ms",
        "expires_at_ms",
        "nonce",
    )
    missing = [key for key in required if key not in payload]
    if missing:
        raise NativePathLeaseError("Native path grant payload is missing required fields.")
    if _required_int(payload, "version") != 1:
        raise NativePathLeaseError("Native path grant version is unsupported.")
    if payload["operation"] != operation:
        raise NativePathLeaseError("Native path grant operation is invalid.")
    if expected_kind and payload["path_kind"] != expected_kind:
        raise NativePathLeaseError("Native path grant kind is invalid.")
    now_ms = int(time.time() * 1000)
    issued_at_ms = _required_int(payload, "issued_at_ms")
    expires_at_ms = _required_int(payload, "expires_at_ms")
    if issued_at_ms >= expires_at_ms:
        raise NativePathLeaseError("Native path grant timestamps are inconsistent.")
    if expires_at_ms <= now_ms:
        raise NativePathLeaseError("Native path grant has expired.")
    if issued_at_ms > now_ms + 30_000:
        raise NativePathLeaseError("Native path grant issue time is invalid.")
    for key in ("canonical_path", "nonce", "token_id_hash", "display_label"):
        raw = payload.get(key)
        if raw is None:
            continue
        if "\x00" in str(raw):

View on GitHub (pinned to 203007d190)

Solutions

  1. Upgrade (or pin) the desktop shell and backend to matching versions so the signer emits version 1.
  2. In test signers, set payload['version'] = 1 exactly.
  3. If you are introducing a new schema version, teach _validate_payload to accept it before shipping signers that emit it.

Example fix

# before
payload = {"version": 2, ...}

# after
payload = {"version": 1, ...}
Defensive patterns

Strategy: try-catch

Validate before calling

payload.get("version") == 1  # after base64url-decoding the payload segment

Try / catch

try:
    grant = verify_native_path_lease(lease, operation=OP)
except NativePathLeaseError as exc:
    if "version is unsupported" in str(exc):
        return error_response(400, "App update required; please restart from the desktop app.")
    raise

Prevention

When it happens

Trigger: A desktop shell from a different app version signing version=2 (or 0) grants; a custom test signer that defaulted version to 0 or omitted thought and set it to something else; or manual payload editing (which would normally fail HMAC first, so in practice this means a different-version signer).

Common situations: App/backend version skew after a partial upgrade (new backend, old shell or vice versa); test harnesses with arbitrary version numbers; schema migration periods where two formats coexist.

Related errors


AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/4695bb88d358fc8b. Report an issue: GitHub.