approveAll cannot be used when managed settings are enabled

Error message

approveAll cannot be used when managed settings are enabled

What it means

The `approveAll` permission handler auto-approves permission requests, but only when managed settings (admin/enterprise policy) are disabled. When managed settings are enabled, automatic blanket approval would bypass admin-imposed policy, so the handler throws immediately. This is an intentional guard against using a permissive handler in a restricted environment.

Solutions

Use a managed-settings-aware permission handler instead of approveAll (one that handles `managedApprovalRequired` requests via real approval flow).
Disable managed settings if you legitimately control the machine and want permissive behavior.
Detect `invocation.managedSettingsEnabled` before registering approveAll and choose a compliant handler.

Example fix

// before
const session = await client.createSession({ permissionHandler: approveAll });
// after
const handler = invocation.managedSettingsEnabled ? managedAwareHandler : approveAll;
const session = await client.createSession({ permissionHandler: handler });

Defensive patterns

Strategy: validation

Validate before calling

if (invocation.managedSettingsEnabled && handler === approveAll) {
  handler = managedAwareHandler;
}

Try / catch

try {
  const session = await client.createSession({ permissionHandler: approveAll });
} catch (e) {
  if (e.message.includes('managed settings are enabled')) {
    session = await client.createSession({ permissionHandler: managedAwareHandler });
  } else throw e;
}

Prevention

Check invocation.managedSettingsEnabled before selecting a permission handler.
Never hardcode approveAll in shared tooling that runs on managed machines.
Prefer managed-settings-aware handlers by default.

When it happens

Trigger: Passing `approveAll` as the PermissionHandler to a session/client while `invocation.managedSettingsEnabled` is true, e.g. constructing a session with a permissive handler on a machine under managed-settings policy.

Common situations: Corporate/enterprise machines with admin-managed policy files running scripts that were written for personal machines with approveAll hardcoded; CI agents that inherit managed settings; copying example code into a policy-controlled environment.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of github/copilot-sdk@cd8cf15dc3 (2026-09-09). Data as JSON: /api/errors/b0d656769d21f5e7. Report an issue: GitHub.

Appendix: source

Thrown at nodejs/src/types.ts:1296

): AttributedPermissionResult {
    const inner = isAttributedPermissionResult(result) ? result.result : result;
    return { kind: "attributed", result: inner, decisionContext };
}

export type PermissionHandler = (
    request: PermissionRequest,
    invocation: { sessionId: string; managedSettingsEnabled?: boolean }
) =>
    | Promise<PermissionRequestResult | AttributedPermissionResult>
    | PermissionRequestResult
    | AttributedPermissionResult;

/**
 * Approves permission requests when managed settings are disabled.
 */
export const approveAll: PermissionHandler = (request, invocation) => {
    if (invocation.managedSettingsEnabled) {
        throw new Error("approveAll cannot be used when managed settings are enabled");
    }
    if ("managedApprovalRequired" in request) {
        const managedApprovalRequired = request.managedApprovalRequired;
        if (managedApprovalRequired !== undefined && managedApprovalRequired !== false) {
            return { kind: "no-result" };
        }
    }
    return { kind: "approve-once" };
};

export const defaultJoinSessionPermissionHandler: PermissionHandler =
    (): PermissionRequestResult => ({
        kind: "no-result",
    });

// ============================================================================
// User Input Request Types
// ============================================================================

View on GitHub (pinned to cd8cf15dc3)