{"record":{"id":"27b861771ffef03b","repo":"paperclipai/paperclip","slug":"runner-permission-mode-invalid","errorCode":"runner_permission_mode_invalid","errorMessage":"${capability.configKey} is not supported by ${provider}.","messagePattern":"(.+?) is not supported by (.+?)\\.","errorType":"error_code","errorClass":"PaperclipRunnerProviderProfileError","httpStatus":null,"severity":"error","filePath":"server/src/services/native-runtime/provider-profile.ts","lineNumber":189,"sourceCode":"\nfunction assertPermissionMode(\n  provider: PaperclipRunnerProvider,\n  config: Record<string, unknown>,\n): void {\n  const capability = PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES[provider];\n  if (!capability.configurable) return;\n  const configured = config[capability.configKey];\n  if (\n    configured !== undefined\n    && resolvePaperclipRunnerPermissionMode(provider, configured) !== configured\n  ) {\n    if (provider === \"codex\") {\n      throw new PaperclipRunnerProviderProfileError(\n        \"paperclip_runner_codex_permission_mode_unqualified\",\n        \"Paperclip Runner currently supports Codex only with codexPermissionMode set to never. Update the agent configuration before starting a new native run.\",\n      );\n    }\n    throw new PaperclipRunnerProviderProfileError(\n      \"runner_permission_mode_invalid\",\n      `${capability.configKey} is not supported by ${provider}.`,\n    );\n  }\n}\n\n/**\n * Rebind a persisted Claude Managed run only to the still-qualified profile\n * and the profile's current company secret. The secret itself may rotate, but\n * the agent configuration must rotate its binding to the same profile-owned\n * secret before recovery can continue.\n */\nexport function assertManagedProfileRecoveryBinding(input: {\n  adapterConfig: unknown;\n  snapshot: {\n    profileId: string;\n    anthropicAgentId: string;\n    agentVersion: string;","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/native-runtime/provider-profile.ts#L171-L207","documentation":"Guard assertPermissionMode in provider-profile.ts: when the provider supports configurable permission mode, config[capability.configKey] must round-trip through resolvePaperclipRunnerPermissionMode unchanged; if normalization alters the value the configured mode is unsupported for that provider and a 'runner_permission_mode_invalid' error is thrown. Fires on mode strings the provider's capability table does not accept.","triggerScenarios":"Thrown at server/src/services/native-runtime/provider-profile.ts:183 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the permission-mode config key to one of the provider's supported modes (e.g. approve-all/approve-reads/deny-all).","Remove the config key to use the provider default mode.","Check PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES for the valid modes per provider before saving config."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}