{"record":{"id":"4357390c2ed09d30","repo":"paperclipai/paperclip","slug":"paperclip-runner-codex-permission-mode-unqualified-435739","errorCode":"paperclip_runner_codex_permission_mode_unqualified","errorMessage":"Paperclip Runner currently supports Codex only with codexPermissionMode set to never. Update the agent configuration before starting a new native run.","messagePattern":"Paperclip Runner currently supports Codex only with codexPermissionMode set to never\\. Update the agent configuration before starting a new native run\\.","errorType":"error_code","errorClass":"PaperclipRunnerProviderProfileError","httpStatus":null,"severity":"error","filePath":"server/src/services/native-runtime/provider-profile.ts","lineNumber":184,"sourceCode":"      `${label} must be an integer between 1 and ${maximum}.`,\n    );\n  }\n  return value;\n}\n\nfunction assertPermissionMode(\n  provider: PaperclipRunnerProvider,\n  config: Record<string, unknown>,\n): void {\n  const capability = PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES[provider];\n  if (!capability.configurable) return;\n  const configured = config[capability.configKey];\n  if (\n    configured !== undefined\n    && resolvePaperclipRunnerPermissionMode(provider, configured) !== configured\n  ) {\n    if (provider === \"codex\") {\n      throw new PaperclipRunnerProviderProfileError(\n        \"paperclip_runner_codex_permission_mode_unqualified\",\n        \"Paperclip Runner currently supports Codex only with codexPermissionMode set to never. Update the agent configuration before starting a new native run.\",\n      );\n    }\n    throw new PaperclipRunnerProviderProfileError(\n      \"runner_permission_mode_invalid\",\n      `${capability.configKey} is not supported by ${provider}.`,\n    );\n  }\n}\n\n/**\n * Rebind a persisted Claude Managed run only to the still-qualified profile\n * and the profile's current company secret. The secret itself may rotate, but\n * the agent configuration must rotate its binding to the same profile-owned\n * secret before recovery can continue.\n */\nexport function assertManagedProfileRecoveryBinding(input: {","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/native-runtime/provider-profile.ts#L166-L202","documentation":"resolvePaperclipRunnerProviderProfile calls assertPermissionMode to validate the agent's configured permission mode for a provider. For Codex, only the \"never\" permission mode is qualified for Paperclip Runner; if codexPermissionMode is set to any other recognized-but-unsupported value, a PaperclipRunnerProviderProfileError with code paperclip_runner_codex_permission_mode_unqualified is thrown before the native run starts.","triggerScenarios":"Starting a native run whose agent config has codexPermissionMode set to a value that is a valid Codex mode but not \"never\" (e.g. \"on-request\", \"on-failure\", \"untrusted\" — any value where resolvePaperclipRunnerPermissionMode(provider, configured) !== configured).","commonSituations":"Agent config copied from a non-runner Codex integration that used interactive permission modes; user picked a permissive mode in the agent settings UI; schema/enum change added new Codex modes not yet qualified for runner use.","solutions":["Edit the agent configuration and set codexPermissionMode to \"never\".","Start a new native run after the config change (existing runs must be restarted).","If the mode must be non-\"never\", use a non-Codex provider or a non-runner execution path that supports that mode."],"exampleFix":"// before (agent config)\n{ \"provider\": \"codex\", \"codexPermissionMode\": \"on-failure\" }\n// after\n{ \"provider\": \"codex\", \"codexPermissionMode\": \"never\" }","handlingStrategy":"validation","validationCode":"if (agent.provider === \"codex\" && agent.codexPermissionMode !== undefined && agent.codexPermissionMode !== \"never\") {\n  throw new Error(\"codexPermissionMode must be 'never' for Paperclip Runner\");\n}","typeGuard":"function isRunnerQualifiedCodexMode(mode: unknown): mode is \"never\" { return mode === \"never\"; }","tryCatchPattern":"try {\n  const profile = resolvePaperclipRunnerProviderProfile(config);\n} catch (err) {\n  if (err instanceof PaperclipRunnerProviderProfileError && err.code === \"paperclip_runner_codex_permission_mode_unqualified\") {\n    // prompt the user to set codexPermissionMode: \"never\" in agent settings\n  } else throw err;\n}","preventionTips":["Restrict the agent settings UI for Codex runner agents to the single qualified mode (never).","Validate agent config at save time, not only at run start.","When copying agent configs from other integrations, strip permission modes not qualified for runner use."],"tags":["configuration","codex","permissions","native-runtime"],"backgroundTag":"unsupported-config-value","analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}