paperclipai/paperclip · error · Error

Refusing unsafe provider-pack output path: ${outputRoot}

Error message

Refusing unsafe provider-pack output path: ${outputRoot}

What it means

Safety guard at the top of build-provider-pack.mjs: the resolved output root (CLI argument or default provider-pack dir) equals the workspace root, the package root, or another explicitly refused location. The script writes/deletes trees and refuses destructive output paths that would clobber the repository itself.

Source

Thrown at packages/paperclip-runner/scripts/build-provider-pack.mjs:34

} from "node:fs";
import { tmpdir } from "node:os";
import { dirname, join, relative, resolve } from "node:path";
import { createRequire } from "node:module";
import { fileURLToPath } from "node:url";

const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
const workspaceRoot = resolve(packageRoot, "../..");
const outputArgument = process.argv.slice(2).find((value) => value !== "--");
const outputRoot = resolve(
  process.cwd(),
  outputArgument ?? join(packageRoot, "provider-pack"),
);
if (
  outputRoot === workspaceRoot ||
  outputRoot === packageRoot ||
  outputRoot === "/"
) {
  throw new Error(`Refusing unsafe provider-pack output path: ${outputRoot}`);
}

const temporaryParent = mkdtempSync(join(tmpdir(), "paperclip-provider-pack-"));
const temporaryRoot = join(temporaryParent, "pack");

function canonicalJson(value) {
  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
  if (value && typeof value === "object") {
    return `{${Object.keys(value)
      .sort()
      .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
      .join(",")}}`;
  }
  return JSON.stringify(value);
}

function sha256File(path) {
  return `sha256:${createHash("sha256")

View on GitHub (pinned to 01ad858492)

Solutions

1. Pass an explicit output directory outside the workspace and package roots
2. Use the default provider-pack output path instead of overriding it
3. If the default now collides with a refused path, move the workspace layout or update the refused-path list in the script

When it happens

Trigger: Thrown at packages/paperclip-runner/scripts/build-provider-pack.mjs:34 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/2b037654c8a6d53f. Report an issue: GitHub.