paperclipai/paperclip · error · PaperclipRunnerProviderProfileError

runner_permission_mode_invalid

runner_permission_mode_invalid

Error message

${capability.configKey} is not supported by ${provider}.

What it means

Guard assertPermissionMode in provider-profile.ts: when the provider supports configurable permission mode, config[capability.configKey] must round-trip through resolvePaperclipRunnerPermissionMode unchanged; if normalization alters the value the configured mode is unsupported for that provider and a 'runner_permission_mode_invalid' error is thrown. Fires on mode strings the provider's capability table does not accept.

Source

Thrown at server/src/services/native-runtime/provider-profile.ts:189

function assertPermissionMode(
  provider: PaperclipRunnerProvider,
  config: Record<string, unknown>,
): void {
  const capability = PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES[provider];
  if (!capability.configurable) return;
  const configured = config[capability.configKey];
  if (
    configured !== undefined
    && resolvePaperclipRunnerPermissionMode(provider, configured) !== configured
  ) {
    if (provider === "codex") {
      throw new PaperclipRunnerProviderProfileError(
        "paperclip_runner_codex_permission_mode_unqualified",
        "Paperclip Runner currently supports Codex only with codexPermissionMode set to never. Update the agent configuration before starting a new native run.",
      );
    }
    throw new PaperclipRunnerProviderProfileError(
      "runner_permission_mode_invalid",
      `${capability.configKey} is not supported by ${provider}.`,
    );
  }
}

/**
 * Rebind a persisted Claude Managed run only to the still-qualified profile
 * and the profile's current company secret. The secret itself may rotate, but
 * the agent configuration must rotate its binding to the same profile-owned
 * secret before recovery can continue.
 */
export function assertManagedProfileRecoveryBinding(input: {
  adapterConfig: unknown;
  snapshot: {
    profileId: string;
    anthropicAgentId: string;
    agentVersion: string;

View on GitHub (pinned to 01ad858492)

Solutions

1. Set the permission-mode config key to one of the provider's supported modes (e.g. approve-all/approve-reads/deny-all).
2. Remove the config key to use the provider default mode.
3. Check PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES for the valid modes per provider before saving config.

When it happens

Trigger: Thrown at server/src/services/native-runtime/provider-profile.ts:183 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/27b861771ffef03b. Report an issue: GitHub.