{"record":{"id":"1cda6f88ca81fdb0","repo":"paperclipai/paperclip","slug":"cloud-managed-instances-may-only-install-plugins-f","errorCode":null,"errorMessage":"cloud-managed instances may only install plugins from the bundled plugin catalog","messagePattern":"cloud-managed instances may only install plugins from the bundled plugin catalog","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"server/src/routes/plugins.ts","lineNumber":1196,"sourceCode":"    if (cloudManaged && !isLocalPath) {\n      res.status(403).json({\n        error:\n          \"npm installs are disabled on cloud-managed instances; only plugins bundled with the application may be installed\",\n      });\n      return;\n    }\n\n    // Canonicalize local install paths on every instance so traversal\n    // segments and symlinks cannot smuggle an aliased path past validation.\n    let canonicalLocalPath: string | undefined;\n    if (isLocalPath) {\n      const validated = await canonicalizeLocalPluginPath(trimmedPackage);\n      if (!validated.ok) {\n        res.status(400).json({ error: `Invalid localPath: ${validated.reason}` });\n        return;\n      }\n      if (cloudManaged && !(await isWithinBundledPluginRoot(validated.canonicalPath))) {\n        res.status(403).json({\n          error:\n            \"cloud-managed instances may only install plugins from the bundled plugin catalog\",\n        });\n        return;\n      }\n      canonicalLocalPath = validated.canonicalPath;\n    }\n\n    try {\n      const installOptions = canonicalLocalPath !== undefined\n        ? { localPath: canonicalLocalPath }\n        : { packageName: trimmedPackage, version: version?.trim() };\n\n      const discovered = await loader.installPlugin(installOptions);\n\n      if (!discovered.manifest) {\n        res.status(500).json({ error: \"Plugin installed but manifest is missing\" });\n        return;","sourceCodeStart":1178,"sourceCodeEnd":1214,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/server/src/routes/plugins.ts#L1178-L1214","documentation":"403 policy guard on POST /plugins/install. Fires on cloud-managed instances for local-path installs whose canonicalized path is not within the bundled plugin catalog root — preventing arbitrary local installs even after path canonicalization.","triggerScenarios":"Thrown at server/src/routes/plugins.ts:1180 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).","If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}