paperclipai/paperclip · error · Error

Plugin SQL references public.${ref.table}, which is not whit

Error message

Plugin SQL references public.${ref.table}, which is not whitelisted

What it means

Isolation guard in assertAllowedPublicRead: a plugin SQL statement references a table in the shared public schema that is not on the instance's coreReadTables whitelist. Plugins may only read the whitelisted core tables; the plugin statement naming the non-whitelisted table is at fault.

Source

Thrown at server/src/services/plugin-database.ts:163

  for (const { pattern, ...mapping } of patterns) {
    for (const match of statement.matchAll(pattern)) {
      if (mapping.groups === "keyword-schema-table") {
        refs.push({ keyword: match[1]!.toLowerCase(), schema: match[2]!, table: match[3]! });
      } else {
        refs.push({ keyword: mapping.keyword, schema: match[1]!, table: match[2]! });
      }
    }
  }
  return refs;
}

function assertAllowedPublicRead(
  ref: SqlRef,
  allowedCoreReadTables: ReadonlySet<string>,
): void {
  if (ref.schema !== "public") return;
  if (!allowedCoreReadTables.has(ref.table)) {
    throw new Error(`Plugin SQL references public.${ref.table}, which is not whitelisted`);
  }
  if (!["from", "join", "references"].includes(ref.keyword)) {
    throw new Error(`Plugin SQL cannot mutate or define objects in public.${ref.table}`);
  }
}

function assertNoBannedSql(statement: string): void {
  const normalized = normaliseSql(statement);
  const banned = [
    /\bcreate\s+extension\b/,
    /\bcreate\s+(?:event\s+)?trigger\b/,
    /\bcreate\s+(?:or\s+replace\s+)?function\b/,
    /\bcreate\s+language\b/,
    /\bgrant\b/,
    /\brevoke\b/,
    /\bsecurity\s+definer\b/,
    /\bcopy\b/,
    /\bcall\b/,

View on GitHub (pinned to 120ae5428f)

Solutions

1. Remove the reference to the non-whitelisted public table, or request whitelisting of that table.

When it happens

Trigger: Thrown at server/src/services/plugin-database.ts:163 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/08bd0b2203b2f3ce. Report an issue: GitHub.