{"record":{"id":"ff5684c9f1d15dfc","repo":"nanocoai/nanoclaw","slug":"cli-scope-must-be-one-of-disabled-group-globa","errorCode":null,"errorMessage":"--cli-scope must be one of: disabled, group, global","messagePattern":"--cli-scope must be one of: disabled, group, global","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/cli/resources/groups.ts","lineNumber":406,"sourceCode":"            | 'assistant_name'\n            | 'max_messages_per_prompt'\n            | 'cli_scope'\n            | 'timezone'\n          >\n        > = {};\n        if (args.provider !== undefined) updates.provider = args.provider as string;\n        const timezone = parseTimezoneFlag(args.timezone);\n        if (timezone !== undefined) updates.timezone = timezone;\n        if (args.model !== undefined) updates.model = args.model as string;\n        if (args.effort !== undefined) updates.effort = args.effort as string;\n        if (args.image_tag !== undefined) updates.image_tag = args.image_tag as string;\n        if (args.assistant_name !== undefined) updates.assistant_name = args.assistant_name as string;\n        if (args.max_messages_per_prompt !== undefined)\n          updates.max_messages_per_prompt = Number(args.max_messages_per_prompt);\n        if (args['cli-scope'] !== undefined || args.cli_scope !== undefined) {\n          const scope = (args['cli-scope'] ?? args.cli_scope) as string;\n          if (!['disabled', 'group', 'global'].includes(scope)) {\n            throw new Error('--cli-scope must be one of: disabled, group, global');\n          }\n          updates.cli_scope = scope;\n        }\n\n        if (Object.keys(updates).length === 0) {\n          throw new Error(\n            'Nothing to update — provide at least one of: --provider, --model, --effort, --image-tag, --assistant-name, --max-messages-per-prompt, --cli-scope, --timezone',\n          );\n        }\n\n        await updateContainerConfigScalars(id, updates);\n\n        const updated = (await getContainerConfig(id))!;\n        return presentConfig(updated);\n      },\n    },\n    'config add-mcp-server': {\n      access: 'approval',","sourceCodeStart":388,"sourceCodeEnd":424,"githubUrl":"https://github.com/nanocoai/nanoclaw/blob/294ef2aee85218b23ad30eda9dfe10e590b54a8c/src/cli/resources/groups.ts#L388-L424","documentation":"The --cli-scope flag passed to `ncl groups config update` is not one of the three allowed values: disabled, group, or global. The handler validates the enum before writing cli_scope to the container config. Note it accepts both --cli-scope and --cli_scope spellings but the value must match exactly (lowercase).","triggerScenarios":"Passing e.g. --cli-scope unrestricted, --cli-scope Group (capitalized), or --cli-scope none. The value is taken from args['cli-scope'] ?? args.cli_scope and checked against the include list before assignment.","commonSituations":"Operators guessing at scope names ('all', 'none', 'admin'); capitalization or whitespace differences from shell quoting; agents attempting to escalate their own scope (also blocked separately for agent callers — changes to cli_scope are approval-gated and cross-group/blocked for agents).","solutions":["Use exactly one of: --cli-scope disabled (agent never learns about ncl), --cli-scope group (default, self-group only), --cli-scope global (unrestricted, owner groups)","Check for shell quoting/whitespace issues if you believe the value is correct","Note agent callers cannot change cli_scope at all — run it as the operator from the host"],"exampleFix":"# before\nncl groups config update --id ag-... --cli-scope all\n# after\nncl groups config update --id ag-... --cli-scope global","handlingStrategy":"validation","validationCode":"const CLI_SCOPES = ['disabled','group','global'] as const;\nif (!CLI_SCOPES.includes(scope)) throw new Error(`--cli-scope must be one of: ${CLI_SCOPES.join(', ')}`);","typeGuard":"type CliScope = 'disabled'|'group'|'global';\nconst isCliScope = (v: unknown): v is CliScope => typeof v === 'string' && ['disabled','group','global'].includes(v);","tryCatchPattern":null,"preventionTips":["Source scope values from a typed constant list, never free-form input","Trim/normalize user input before passing it as --cli-scope"],"tags":["cli","enum-validation","container-config"],"backgroundTag":"invalid-enum-value","analyzedSha":"294ef2aee85218b23ad30eda9dfe10e590b54a8c","analyzedAt":"2026-08-28T13:59:10.357Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}