{"record":{"id":"91007a7395f8e8fd","repo":"paperclipai/paperclip","slug":"paperclip-runner-claude-managed-recovery-secret-mi","errorCode":"paperclip_runner_claude_managed_recovery_secret_mismatch","errorMessage":"The persisted Claude Managed run is not bound to its profile's current API-key secret.","messagePattern":"The persisted Claude Managed run is not bound to its profile's current API-key secret\\.","errorType":"error_code","errorClass":"PaperclipRunnerProviderProfileError","httpStatus":null,"severity":"error","filePath":"server/src/services/native-runtime/provider-profile.ts","lineNumber":236,"sourceCode":"  };\n}): void {\n  const { snapshot, stored } = input;\n  if (\n    snapshot.profileId !== stored.id\n    || snapshot.anthropicAgentId !== stored.anthropicAgentId\n    || snapshot.agentVersion !== stored.agentVersion\n    || snapshot.environmentId !== stored.environmentId\n    || snapshot.betaVersion !== stored.betaVersion\n  ) {\n    throw new PaperclipRunnerProviderProfileError(\n      \"paperclip_runner_claude_managed_recovery_identity_mismatch\",\n      \"The persisted Claude Managed identity no longer matches its qualified profile.\",\n    );\n  }\n  const rawBinding = asRecord(asRecord(input.adapterConfig).env).ANTHROPIC_API_KEY;\n  const boundSecretId = asRecord(rawBinding).secretId;\n  if (boundSecretId !== stored.apiKeySecretId) {\n    throw new PaperclipRunnerProviderProfileError(\n      \"paperclip_runner_claude_managed_recovery_secret_mismatch\",\n      \"The persisted Claude Managed run is not bound to its profile's current API-key secret.\",\n    );\n  }\n}\n\n/** Revalidate the operator's AWS profile revocation and immutable identity on recovery. */\nexport function assertAgentCoreProfileRecoveryBinding(input: {\n  snapshot: {\n    profileId: string;\n    region: string;\n    accountId: string;\n    harnessArn: string;\n    harnessVersion: string;\n    endpointArn: string;\n    endpointQualifier: string;\n    agentRuntimeArn: string;\n    memoryArn: string;","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/native-runtime/provider-profile.ts#L218-L254","documentation":"Guard assertManagedProfileRecoveryBinding: beyond identity fields, the persisted Claude Managed run must be bound to the profile's current API-key secret; when the adapter-config binding record no longer matches the profile's apiKeySecretId, the error 'paperclip_runner_claude_managed_recovery...' is thrown. Fires after the profile's API key was rotated or re-created, invalidating recovery of in-flight runs.","triggerScenarios":"Thrown at server/src/services/native-runtime/provider-profile.ts:230 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-bind the run to the profile's current API-key secret by re-qualifying and starting a fresh run.","Restore the previously bound secret if rotation was accidental.","Update the stored binding record to the new secret id through the supported profile-management flow before resuming."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-02T18:44:00.616Z","contentChangedAt":"2026-09-02T18:44:00.616Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}