paperclipai/paperclip · error · Error

Refusing unsafe provider-pack output path

Error message

Refusing unsafe provider-pack output path: ${outputRoot}

What it means

Safety guard at the top of build-provider-pack.mjs: the resolved output root (CLI argument or default provider-pack dir) equals the workspace root, the package root, or another explicitly refused location. The script writes/deletes trees and refuses destructive output paths that would clobber the repository itself.

Solutions

1. Pass an explicit output directory outside the workspace and package roots
2. Use the default provider-pack output path instead of overriding it
3. If the default now collides with a refused path, move the workspace layout or update the refused-path list in the script

When it happens

Trigger: Thrown at packages/paperclip-runner/scripts/build-provider-pack.mjs:34 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@3f1d897a7c (2026-09-10). Data as JSON: /api/errors/2b037654c8a6d53f. Report an issue: GitHub.

Appendix: source

Thrown at packages/paperclip-runner/scripts/build-provider-pack.mjs:34

} from "node:fs";
import { tmpdir } from "node:os";
import { dirname, join, relative, resolve } from "node:path";
import { createRequire } from "node:module";
import { fileURLToPath } from "node:url";

const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
const workspaceRoot = resolve(packageRoot, "../..");
const outputArgument = process.argv.slice(2).find((value) => value !== "--");
const outputRoot = resolve(
  process.cwd(),
  outputArgument ?? join(packageRoot, "provider-pack"),
);
if (
  outputRoot === workspaceRoot ||
  outputRoot === packageRoot ||
  outputRoot === "/"
) {
  throw new Error(`Refusing unsafe provider-pack output path: ${outputRoot}`);
}

const temporaryParent = mkdtempSync(join(tmpdir(), "paperclip-provider-pack-"));
const temporaryRoot = join(temporaryParent, "pack");

function canonicalJson(value) {
  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
  if (value && typeof value === "object") {
    return `{${Object.keys(value)
      .sort()
      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
      .join(",")}}`;
  }
  return JSON.stringify(value);
}

function sha256File(path) {
  return `sha256:${createHash("sha256")

View on GitHub (pinned to 3f1d897a7c)