paperclipai/paperclip · error

packageName contains invalid characters

Error message

packageName contains invalid characters

What it means

400 security guard on POST /plugins/install. Fires when a non-local-path package name contains shell/OS-unsafe characters (<>:"|?*); a basic injection-prevention check rejects such names before registry or filesystem access.

Source

Thrown at server/src/routes/plugins.ts:1171

      res.status(400).json({ error: "version must be a string if provided" });
      return;
    }

    if (isLocalPath !== undefined && typeof isLocalPath !== "boolean") {
      res.status(400).json({ error: "isLocalPath must be a boolean if provided" });
      return;
    }

    // Validate package name format
    const trimmedPackage = packageName.trim();
    if (trimmedPackage.length === 0) {
      res.status(400).json({ error: "packageName cannot be empty" });
      return;
    }

    // Basic security check for package name (prevent injection)
    if (!isLocalPath && /[<>:"|?*]/.test(trimmedPackage)) {
      res.status(400).json({ error: "packageName contains invalid characters" });
      return;
    }

    // Cloud install floor: on harness-managed instances only bundled-catalog
    // sources are installable, regardless of actor privileges or flag state.
    const cloudManaged = isCloudManagedInstance();
    if (cloudManaged && !isLocalPath) {
      res.status(403).json({
        error:
          "npm installs are disabled on cloud-managed instances; only plugins bundled with the application may be installed",
      });
      return;
    }

    // Canonicalize local install paths on every instance so traversal
    // segments and symlinks cannot smuggle an aliased path past validation.
    let canonicalLocalPath: string | undefined;
    if (isLocalPath) {

View on GitHub (pinned to a7e689b3c3)

Solutions

1. Fix the offending parameter to satisfy the constraint stated in the error message (type, range, or allowed values), then retry.
2. Refer to the route's request validation in the named file and the shared validators for the accepted format.

When it happens

Trigger: Thrown at server/src/routes/plugins.ts:1155 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-18). Data as JSON: /api/errors/10f26e12cf5576be. Report an issue: GitHub.