nanocoai/nanoclaw · error · Error

--cli-scope must be one of: disabled, group, global

Error message

--cli-scope must be one of: disabled, group, global

What it means

The --cli-scope flag passed to `ncl groups config update` is not one of the three allowed values: disabled, group, or global. The handler validates the enum before writing cli_scope to the container config. Note it accepts both --cli-scope and --cli_scope spellings but the value must match exactly (lowercase).

Source

Thrown at src/cli/resources/groups.ts:406

            | 'assistant_name'
            | 'max_messages_per_prompt'
            | 'cli_scope'
            | 'timezone'
          >
        > = {};
        if (args.provider !== undefined) updates.provider = args.provider as string;
        const timezone = parseTimezoneFlag(args.timezone);
        if (timezone !== undefined) updates.timezone = timezone;
        if (args.model !== undefined) updates.model = args.model as string;
        if (args.effort !== undefined) updates.effort = args.effort as string;
        if (args.image_tag !== undefined) updates.image_tag = args.image_tag as string;
        if (args.assistant_name !== undefined) updates.assistant_name = args.assistant_name as string;
        if (args.max_messages_per_prompt !== undefined)
          updates.max_messages_per_prompt = Number(args.max_messages_per_prompt);
        if (args['cli-scope'] !== undefined || args.cli_scope !== undefined) {
          const scope = (args['cli-scope'] ?? args.cli_scope) as string;
          if (!['disabled', 'group', 'global'].includes(scope)) {
            throw new Error('--cli-scope must be one of: disabled, group, global');
          }
          updates.cli_scope = scope;
        }

        if (Object.keys(updates).length === 0) {
          throw new Error(
            'Nothing to update — provide at least one of: --provider, --model, --effort, --image-tag, --assistant-name, --max-messages-per-prompt, --cli-scope, --timezone',
          );
        }

        await updateContainerConfigScalars(id, updates);

        const updated = (await getContainerConfig(id))!;
        return presentConfig(updated);
      },
    },
    'config add-mcp-server': {
      access: 'approval',

View on GitHub (pinned to 294ef2aee8)

Solutions

1. Use exactly one of: --cli-scope disabled (agent never learns about ncl), --cli-scope group (default, self-group only), --cli-scope global (unrestricted, owner groups)
2. Check for shell quoting/whitespace issues if you believe the value is correct
3. Note agent callers cannot change cli_scope at all — run it as the operator from the host

Example fix

# before
ncl groups config update --id ag-... --cli-scope all
# after
ncl groups config update --id ag-... --cli-scope global

const CLI_SCOPES = ['disabled','group','global'] as const;
if (!CLI_SCOPES.includes(scope)) throw new Error(`--cli-scope must be one of: ${CLI_SCOPES.join(', ')}`);

type CliScope = 'disabled'|'group'|'global';
const isCliScope = (v: unknown): v is CliScope => typeof v === 'string' && ['disabled','group','global'].includes(v);

When it happens

Trigger: Passing e.g. --cli-scope unrestricted, --cli-scope Group (capitalized), or --cli-scope none. The value is taken from args['cli-scope'] ?? args.cli_scope and checked against the include list before assignment.

Common situations: Operators guessing at scope names ('all', 'none', 'admin'); capitalization or whitespace differences from shell quoting; agents attempting to escalate their own scope (also blocked separately for agent callers — changes to cli_scope are approval-gated and cross-group/blocked for agents).

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• No container config for group: ${id}
• Nothing to update — provide at least one of: --provider, --m
• ${name} must be one of: ${allowed.join(', ')}
• --${column.name.replace(/_/g, '-')} must be true or false
• ${def.name} id is required

AI-assisted analysis of nanocoai/nanoclaw@294ef2aee8 (2026-08-28). Data as JSON: /api/errors/ff5684c9f1d15dfc. Report an issue: GitHub.