{"record":{"id":"7419fec76ba25d99","repo":"xai-org/grok-build","slug":"e-7419fe","errorCode":null,"errorMessage":"{e}","messagePattern":"\\{e\\}","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-update/src/auto_update.rs","lineNumber":2737,"sourceCode":"    };\n    // Persist installer if not already saved\n    let cfg = config::load_config().await;\n    if cfg.cli.installer.is_none() {\n        let _ = config::update_config(|st| {\n            st.cli.installer = Some(installer.to_string());\n        })\n        .await;\n    }\n\n    heal_managed_install(installer).await;\n\n    let current_version = get_installed_grok_version();\n    let policy = config::VersionPolicy::resolve();\n\n    // When --version is given, skip the latest-version check and install directly\n    if let Some(version) = pinned_version {\n        if let Err(e) = crate::version_policy::check_install_target(&policy, version) {\n            anyhow::bail!(\"{e}\");\n        }\n        eprintln!(\n            \"Installing Grok {} (current: {})...\",\n            version, current_version\n        );\n        eprintln!();\n        run_install_script(installer, Some(version), update_config, trigger).await?;\n        refresh_deployment_config().await;\n        if let Err(e) = config::update_config(|st| {\n            st.cli.auto_update = Some(false);\n        })\n        .await\n        {\n            tracing::warn!(\"Failed to persist auto_update=false for pinned install: {e}\");\n        }\n        eprintln!(\"  ✓ grok v{} installed successfully!\", version);\n        eprintln!(\"  Please restart Grok.\");\n        return Ok(Some(version.to_string()));","sourceCodeStart":2719,"sourceCodeEnd":2755,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-update/src/auto_update.rs#L2719-L2755","documentation":"This error surfaces when the user pins an explicit version (--version) but the resolved VersionPolicy rejects that install target. auto_update.rs calls crate::version_policy::check_install_target(&policy, version) before installing, and any rejection is re-bailed verbatim with anyhow::bail!(\"{e}\") so the policy's message propagates to the CLI user.","triggerScenarios":"Running the updater with a pinned version while the resolved VersionPolicy (from deployment/enterprise config) forbids it — e.g. the pinned version is below the enforced minimum, violates channel rules, or is otherwise not an allowed install target per check_install_target.","commonSituations":"Admin-enforced minimum-version policies in managed environments; developers trying to downgrade to an older version that policy disallows; stale local config.toml pinning a version no longer permitted by refreshed deployment config.","solutions":["Read the propagated policy message; it states which policy check (minimum version, channel, etc.) the pinned version failed","Remove the --version pin so the updater picks the latest allowed release","Update the pinned version to one that satisfies the policy's minimum/allowed range","Ask the administrator to relax the VersionPolicy in the deployment config if the older version is genuinely required"],"exampleFix":"// before\ngrok-update install --version 0.1.2   // below policy minimum -> bails\n// after\ngrok-update install --version 0.9.0   // meets VersionPolicy minimum\n# or omit --version entirely to install the latest allowed release","handlingStrategy":"validation","validationCode":"// Validate the pinned version against policy before invoking the updater\nlet policy = xai_grok_update::config::VersionPolicy::resolve();\nif let Err(policy_err) = xai_grok_update::version_policy::check_install_target(&policy, pinned_version) {\n    eprintln!(\"Pinned version rejected by policy: {policy_err}\");\n    std::process::exit(2);\n}","typeGuard":null,"tryCatchPattern":"// Rust callers embedding the updater\nmatch run_update(Some(pinned_version)).await {\n    Ok(plan) => apply(plan),\n    Err(e) if e.to_string().contains(\"policy\") || is_policy_rejection(&e) => {\n        eprintln!(\"Version pin violates policy: {e}\"); // prompt for allowed version\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Query the effective VersionPolicy before pinning a version in scripts/CI","Prefer letting the updater pick the latest allowed release instead of hard-pinning","Keep deployment-config minimums in sync with actually published versions","Log the resolved policy alongside the pinned version for easier debugging"],"tags":["version-policy","pinned-version","cli"],"backgroundTag":"version-policy-violation","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}