{"record":{"id":"b0d656769d21f5e7","repo":"github/copilot-sdk","slug":"approveall-cannot-be-used-when-managed-settings-ar","errorCode":null,"errorMessage":"approveAll cannot be used when managed settings are enabled","messagePattern":"approveAll cannot be used when managed settings are enabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nodejs/src/types.ts","lineNumber":1296,"sourceCode":"): AttributedPermissionResult {\n    const inner = isAttributedPermissionResult(result) ? result.result : result;\n    return { kind: \"attributed\", result: inner, decisionContext };\n}\n\nexport type PermissionHandler = (\n    request: PermissionRequest,\n    invocation: { sessionId: string; managedSettingsEnabled?: boolean }\n) =>\n    | Promise<PermissionRequestResult | AttributedPermissionResult>\n    | PermissionRequestResult\n    | AttributedPermissionResult;\n\n/**\n * Approves permission requests when managed settings are disabled.\n */\nexport const approveAll: PermissionHandler = (request, invocation) => {\n    if (invocation.managedSettingsEnabled) {\n        throw new Error(\"approveAll cannot be used when managed settings are enabled\");\n    }\n    if (\"managedApprovalRequired\" in request) {\n        const managedApprovalRequired = request.managedApprovalRequired;\n        if (managedApprovalRequired !== undefined && managedApprovalRequired !== false) {\n            return { kind: \"no-result\" };\n        }\n    }\n    return { kind: \"approve-once\" };\n};\n\nexport const defaultJoinSessionPermissionHandler: PermissionHandler =\n    (): PermissionRequestResult => ({\n        kind: \"no-result\",\n    });\n\n// ============================================================================\n// User Input Request Types\n// ============================================================================","sourceCodeStart":1278,"sourceCodeEnd":1314,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/nodejs/src/types.ts#L1278-L1314","documentation":"The `approveAll` permission handler auto-approves permission requests, but only when managed settings (admin/enterprise policy) are disabled. When managed settings are enabled, automatic blanket approval would bypass admin-imposed policy, so the handler throws immediately. This is an intentional guard against using a permissive handler in a restricted environment.","triggerScenarios":"Passing `approveAll` as the PermissionHandler to a session/client while `invocation.managedSettingsEnabled` is true, e.g. constructing a session with a permissive handler on a machine under managed-settings policy.","commonSituations":"Corporate/enterprise machines with admin-managed policy files running scripts that were written for personal machines with approveAll hardcoded; CI agents that inherit managed settings; copying example code into a policy-controlled environment.","solutions":["Use a managed-settings-aware permission handler instead of approveAll (one that handles `managedApprovalRequired` requests via real approval flow).","Disable managed settings if you legitimately control the machine and want permissive behavior.","Detect `invocation.managedSettingsEnabled` before registering approveAll and choose a compliant handler."],"exampleFix":"// before\nconst session = await client.createSession({ permissionHandler: approveAll });\n// after\nconst handler = invocation.managedSettingsEnabled ? managedAwareHandler : approveAll;\nconst session = await client.createSession({ permissionHandler: handler });","handlingStrategy":"validation","validationCode":"if (invocation.managedSettingsEnabled && handler === approveAll) {\n  handler = managedAwareHandler;\n}","typeGuard":null,"tryCatchPattern":"try {\n  const session = await client.createSession({ permissionHandler: approveAll });\n} catch (e) {\n  if (e.message.includes('managed settings are enabled')) {\n    session = await client.createSession({ permissionHandler: managedAwareHandler });\n  } else throw e;\n}","preventionTips":["Check invocation.managedSettingsEnabled before selecting a permission handler.","Never hardcode approveAll in shared tooling that runs on managed machines.","Prefer managed-settings-aware handlers by default."],"tags":["permissions","managed-settings","configuration"],"backgroundTag":"conflicting-config-options","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}