nanocoai/nanoclaw · error · Error

--role is required

Error message

--role is required

What it means

Thrown by the `ncl roles revoke` handler when `--user` was provided but `--role` is missing. The DELETE statement needs both the user and the role name to identify the exact `user_roles` row, so the CLI validates both before executing.

Source

Thrown at src/cli/resources/roles.ts:62

             ON CONFLICT DO NOTHING`,
          userId,
          role,
          groupId,
          grantedBy,
          new Date().toISOString(),
        );
        return { user_id: userId, role, agent_group_id: groupId };
      },
    },
    revoke: {
      access: 'approval',
      description: 'Revoke a role. Use --user, --role, and --group if scoped.',
      handler: async (args) => {
        const userId = args.user as string;
        const role = args.role as string;
        const groupId = (args.group as string) ?? null;
        if (!userId) throw new Error('--user is required');
        if (!role) throw new Error('--role is required');
        const result = await getDb().run(
          'DELETE FROM user_roles WHERE user_id = ? AND role = ? AND agent_group_id IS NOT DISTINCT FROM ?',
          userId,
          role,
          groupId,
        );
        if (result.changes === 0) throw new Error('role not found');
        return { revoked: { user_id: userId, role, agent_group_id: groupId } };
      },
    },
  },
});

View on GitHub (pinned to 294ef2aee8)

Solutions

1. Add the role: `ncl roles revoke --user <id> --role owner` or `--role admin`
2. Check which roles the user currently holds with `ncl roles list --user <id>` (or `ncl roles list`) before revoking
3. Include --group when the role was granted group-scoped, otherwise the revoke targets the global row

Example fix

# before
ncl roles revoke --user telegram:alice
# after
ncl roles revoke --user telegram:alice --role admin

if (!role || !['owner', 'admin'].includes(role)) {
  throw new Error('roles revoke needs --role owner|admin');
}
await execNcl(['roles', 'revoke', '--user', userId, '--role', role]);

const isRoleName = (r: unknown): r is 'owner' | 'admin' => r === 'owner' || r === 'admin';

catch (e) { if (e.message === '--role is required') printUsageAndExit(1); else throw e; }

When it happens

Trigger: Running `ncl roles revoke --user telegram:alice` with no --role. Passes the userId check, then fails on the empty role check.

Common situations: Assuming revoke with only --user removes all of that user's roles; typo'd flag names; passing a value like --role=Admin (this error is only about absence — invalid values simply match zero rows and raise 'role not found' instead).

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• --role must be owner or admin
• owner role is always global (do not pass --group)
• --${column.name.replace(/_/g, '-')} must be true or false
• ${col.name} must be one of: ${col.enum.join(', ')}
• Nothing to update — provide at least one of: --provider, --m

AI-assisted analysis of nanocoai/nanoclaw@294ef2aee8 (2026-08-28). Data as JSON: /api/errors/19460917eb284d2e. Report an issue: GitHub.