{"record":{"id":"62962b72eb02b71a","repo":"paperclipai/paperclip","slug":"existing-anthropic-environment-does-not-match-pape","errorCode":null,"errorMessage":"Existing Anthropic Environment does not match Paperclip's no-network, no-package profile","messagePattern":"Existing Anthropic Environment does not match Paperclip's no-network, no-package profile","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/src/commands/managed-agent.ts","lineNumber":191,"sourceCode":"export function assertSafeManagedEnvironment(environment: Record<string, unknown>): void {\n  const config = record(environment.config);\n  const networking = record(config.networking);\n  const packages = record(config.packages);\n  const installed = Object.entries(packages)\n    .filter(([key]) => key !== \"type\")\n    .flatMap(([, value]) => (Array.isArray(value) ? value : [value]))\n    .filter((value) => value !== undefined && value !== null);\n  if (\n    environment.archived_at !== null\n    || config.type !== \"cloud\"\n    || networking.type !== \"limited\"\n    || networking.allow_mcp_servers !== false\n    || networking.allow_package_managers !== false\n    || !Array.isArray(networking.allowed_hosts)\n    || networking.allowed_hosts.length > 0\n    || installed.length > 0\n  ) {\n    throw new Error(\n      \"Existing Anthropic Environment does not match Paperclip's no-network, no-package profile\",\n    );\n  }\n}\n\nexport function assertSafeManagedAgent(agent: Record<string, unknown>): void {\n  const model = typeof agent.model === \"string\" ? agent.model : record(agent.model).id;\n  if (\n    agent.archived_at !== null\n    || agent.system !== CLAUDE_MANAGED_SYSTEM_PROMPT\n    || typeof model !== \"string\"\n    || !model\n    || !Array.isArray(agent.tools)\n    || agent.tools.length > 0\n    || !Array.isArray(agent.mcp_servers)\n    || agent.mcp_servers.length > 0\n    || !Array.isArray(agent.skills)\n    || agent.skills.length > 0","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/paperclipai/paperclip/blob/5716fe907e596ce73501408fc6efdb19fb61edf2/cli/src/commands/managed-agent.ts#L173-L209","documentation":"`assertSafeManagedEnvironment` verifies that an existing Anthropic Environment matches Paperclip's locked profile: not archived, cloud type, limited networking with MCP servers and package managers disabled, an empty allowed_hosts list, and no installed packages. Any deviation throws this error. It is a safety check so Paperclip never drives an environment with broader network/package capabilities than expected.","triggerScenarios":"Passing --environment-id pointing at an environment you configured manually with allowed_hosts entries, MCP servers enabled, or packages installed; an environment whose config.type is not \"cloud\" or networking.type is not \"limited\"; reusing an archived environment; someone loosened the environment's networking settings after Paperclip created it.","commonSituations":"Hand-editing the environment in the Anthropic console to add an allowed host for debugging, then the next Paperclip run rejects it; pointing the CLI at a pre-existing general-purpose environment instead of one Paperclip created; beta API changes altering field defaults so a previously-valid env no longer parses as safe.","solutions":["Omit --environment-id and let Paperclip create/resolve a matching environment automatically","Recreate the environment via Paperclip setup so it is provisioned with the locked profile","If you want to keep the environment, revert its config: type cloud, networking limited with allow_mcp_servers=false, allow_package_managers=false, allowed_hosts=[], no packages, unarchive it","Inspect the environment JSON (GET /v1/environments/:id) and compare each field against the profile to find the offending one"],"exampleFix":"// before\n--environment-id env_existing_general_purpose\n// after (let Paperclip resolve/create)\npaperclip managed-agent setup ... # no --environment-id\n// or fix the env config:\n{\"config\":{\"type\":\"cloud\",\"networking\":{\"type\":\"limited\",\"allow_mcp_servers\":false,\"allow_package_managers\":false,\"allowed_hosts\":[]},\"packages\":{}}}","handlingStrategy":"type-guard","validationCode":"// Fetch and check before passing --environment-id:\nconst env = await getEnvironment(key, environmentId);\nconst cfg = env.config ?? {};\nconst net = cfg.networking ?? {};\nconst unsafe = env.archived_at !== null || cfg.type !== \"cloud\" || net.type !== \"limited\"\n  || net.allow_mcp_servers !== false || net.allow_package_managers !== false\n  || (net.allowed_hosts?.length ?? 1) > 0 || Object.keys(cfg.packages ?? {}).filter(k => k !== \"type\").length > 0;\nif (unsafe) throw new Error(\"Environment does not match the locked no-network/no-package profile\");","typeGuard":"function isSafeEnvironment(env: Record<string, unknown>): boolean {\n  const cfg = (env.config ?? {}) as Record<string, unknown>;\n  const net = (cfg.networking ?? {}) as Record<string, unknown>;\n  const pkgs = (cfg.packages ?? {}) as Record<string, unknown>;\n  return env.archived_at === null && cfg.type === \"cloud\" && net.type === \"limited\"\n    && net.allow_mcp_servers === false && net.allow_package_managers === false\n    && Array.isArray(net.allowed_hosts) && net.allowed_hosts.length === 0\n    && Object.keys(pkgs).filter(k => k !== \"type\").length === 0;\n}","tryCatchPattern":"try {\n  await setupManagedAgent(opts);\n} catch (err) {\n  if (err instanceof Error && err.message.includes(\"no-network, no-package profile\")) {\n    console.error(\"Environment drifted from the locked profile — recreate via Paperclip or revert its config\"); process.exitCode = 2;\n  } else throw err;\n}","preventionTips":["Let Paperclip create environments instead of reusing hand-configured ones","Don't edit Anthropic Environment networking/package settings in the console between runs","Never pass --environment-id for archived or general-purpose environments","Re-assert the profile after any manual environment change"],"tags":["safety-check","configuration-drift","anthropic-environment","profile-mismatch"],"backgroundTag":"config-profile-mismatch","analyzedSha":"5716fe907e596ce73501408fc6efdb19fb61edf2","analyzedAt":"2026-09-02T18:44:00.616Z","contentChangedAt":"2026-09-02T18:44:00.616Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}