paperclipai/paperclip · error

packageName cannot be empty

Error message

packageName cannot be empty

What it means

400 validation guard on POST /plugins/install. Fires when packageName is present and a string but trims to the empty string — a whitespace-only package name carries no target and is rejected.

Source

Thrown at server/src/routes/plugins.ts:1165

    if (!packageName || typeof packageName !== "string") {
      res.status(400).json({ error: "packageName is required and must be a string" });
      return;
    }

    if (version !== undefined && typeof version !== "string") {
      res.status(400).json({ error: "version must be a string if provided" });
      return;
    }

    if (isLocalPath !== undefined && typeof isLocalPath !== "boolean") {
      res.status(400).json({ error: "isLocalPath must be a boolean if provided" });
      return;
    }

    // Validate package name format
    const trimmedPackage = packageName.trim();
    if (trimmedPackage.length === 0) {
      res.status(400).json({ error: "packageName cannot be empty" });
      return;
    }

    // Basic security check for package name (prevent injection)
    if (!isLocalPath && /[<>:"|?*]/.test(trimmedPackage)) {
      res.status(400).json({ error: "packageName contains invalid characters" });
      return;
    }

    // Cloud install floor: on harness-managed instances only bundled-catalog
    // sources are installable, regardless of actor privileges or flag state.
    const cloudManaged = isCloudManagedInstance();
    if (cloudManaged && !isLocalPath) {
      res.status(403).json({
        error:
          "npm installs are disabled on cloud-managed instances; only plugins bundled with the application may be installed",
      });
      return;

View on GitHub (pinned to a7e689b3c3)

Solutions

  1. Fix the offending parameter to satisfy the constraint stated in the error message (type, range, or allowed values), then retry.
  2. Refer to the route's request validation in the named file and the shared validators for the accepted format.
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at server/src/routes/plugins.ts:1149 when the library encounters an invalid state.

Common situations: See trigger scenarios.


AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-18). Data as JSON: /api/errors/923c9be624eeafee. Report an issue: GitHub.