paperclipai/paperclip · error

eval-session managedProfile requires provider claude_managed

Error message

eval-session managedProfile requires provider claude_managed

What it means

managedProfile is a provider-specific credential/config block valid only for provider 'claude_managed'. If any other provider is chosen and request.managedProfile is present, parseEvalSessionRequest rejects the request. (When provider IS claude_managed, parseManagedProfile instead deeply validates the object.) This prevents stale Claude Managed Agents API credentials from being attached to unrelated providers.

Source

Thrown at packages/paperclip-runner/src/cli/eval-session-contract.ts:264

    throw new Error("eval-session acpxAgent must be codex or claude");
  }
  if (provider !== "acpx" && acpxAgent !== undefined) {
    throw new Error("eval-session acpxAgent requires provider acpx");
  }
  const managedProfileInput = input.managedProfile === null
    ? undefined
    : input.managedProfile;
  const agentCoreProfileInput = input.agentCoreProfile === null
    ? undefined
    : input.agentCoreProfile;
  const managedProfile = provider === "claude_managed"
    ? parseManagedProfile(managedProfileInput)
    : undefined;
  const agentCoreProfile = provider === "aws_agentcore"
    ? parseAgentCoreProfile(agentCoreProfileInput)
    : undefined;
  if (provider !== "claude_managed" && managedProfileInput !== undefined) {
    throw new Error("eval-session managedProfile requires provider claude_managed");
  }
  if (provider !== "aws_agentcore" && agentCoreProfileInput !== undefined) {
    throw new Error("eval-session agentCoreProfile requires provider aws_agentcore");
  }
  if (input.nativeResume !== undefined) {
    throw new Error(
      "eval-session nativeResume requires a retained live-session checkpoint",
    );
  }
  if (input.includeCollaborationModeInstructions === false) {
    throw new Error(
      "current CapabilityLiveSessionService requires collaboration-mode instructions",
    );
  }

  const runnerd = object(input.runnerd, "request.runnerd");
  const digest = text(runnerd.sha256, "request.runnerd.sha256");
  if (!/^(?:sha256:)?[a-f0-9]{64}$/i.test(digest)) {

View on GitHub (pinned to 01ad858492)

Solutions

1. Remove managedProfile from the request when provider is not 'claude_managed'.
2. Set provider to 'claude_managed' if the managed profile (with model 'claude-sonnet-5') was intended.
3. Make the config builder include managedProfile only when provider === 'claude_managed'.
4. Note that claude_managed additionally requires model exactly 'claude-sonnet-5' and a fully valid managedProfile object (betaVersion 'managed-agents-2026-04-01', profileId, anthropicAgentId, environmentId, maxSessionListCostUsd, etc.).

Example fix

// before
const request = { schema, provider: "aws_agentcore", managedProfile: profile, agentCoreProfile: acp, ... };
// after
const request = { schema, provider: "aws_agentcore", agentCoreProfile: acp, ... };
// or, if Claude Managed was intended:
const request = { schema, provider: "claude_managed", model: "claude-sonnet-5", managedProfile: profile, ... };

function assertManagedProfileProviderPair(request: { provider?: string; managedProfile?: unknown }): void {
  const provider = request.provider ?? "codex";
  if (provider !== "claude_managed" && request.managedProfile !== undefined) {
    throw new Error(`managedProfile set but provider is '${provider}'; managedProfile requires provider 'claude_managed'`);
  }
}

function managedProfileAllowed(r: { provider?: string; managedProfile?: unknown }): boolean {
  return r.managedProfile === undefined || (r.provider ?? "codex") === "claude_managed";
}

try {
  const parsed = parseEvalSessionRequest(raw);
} catch (err) {
  if (err instanceof Error && err.message === "eval-session managedProfile requires provider claude_managed") {
    console.error(`Drop managedProfile or set provider='claude_managed' (got '${raw.provider ?? "codex"}').`);
  } else throw err;
}

When it happens

Trigger: Calling parseEvalSessionRequest with e.g. {provider:'codex', managedProfile:{...}} or {provider:'aws_agentcore', managedProfile:{...}} — typically a config that previously used claude_managed had its provider switched without removing managedProfile.

Common situations: Toggling provider between claude_managed and codex/aws_agentcore in a shared eval config; copying a request template that includes managedProfile; CI matrix parameterizing only provider and leaving the profile block static.

Related errors

• eval-session provider/driver mismatch
• eval-session acpxAgent requires provider acpx
• ${label} is not a regular file at ${canonical}.
• ${path} must be an object
• ${path} must be a non-empty string

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/d31cbc3fd98c3807. Report an issue: GitHub.