invalid --approval-mode %q: expected one of manual, balanced

Error message

invalid --approval-mode %q: expected one of manual, balanced, auto

What it means

Returned by parseApprovalMode in pkg/cmd/pulumi/neo/neo.go:325 when the --approval-mode flag value does not match one of the NeoApprovalMode enum values manual, balanced, or auto. The parser does a case-sensitive switch over the enum strings and rejects all other inputs before a session is started.

Source

Thrown at pkg/cmd/pulumi/neo/neo.go:325

// valueOrEmpty maps the bare-flag sentinel back to "" so callers see an explicit id or nothing.
func valueOrEmpty(v string) string {
	if v == debugLatestSentinel {
		return ""
	}
	return v
}

// parseApprovalMode validates the --approval-mode flag value against the
// NeoApprovalMode enum. The cloud rejects unknown values too, but a CLI-side
// check produces a clearer error before any network round-trip.
func parseApprovalMode(s string) (client.NeoApprovalMode, error) {
	switch client.NeoApprovalMode(s) {
	case client.NeoApprovalModeManual,
		client.NeoApprovalModeBalanced,
		client.NeoApprovalModeAuto:
		return client.NeoApprovalMode(s), nil
	}
	return "", fmt.Errorf("invalid --approval-mode %q: expected one of manual, balanced, auto", s)
}

// parsePermissionMode validates the --permission-mode flag value against the
// NeoPermissionMode enum.
func parsePermissionMode(s string) (client.NeoPermissionMode, error) {
	switch client.NeoPermissionMode(s) {
	case client.NeoPermissionModeDefault, client.NeoPermissionModeReadOnly:
		return client.NeoPermissionMode(s), nil
	}
	return "", fmt.Errorf("invalid --permission-mode %q: expected one of default, read-only", s)
}

// neoRunOptions carries everything runNeo needs to start a Neo session.
type neoRunOptions struct {
	prompt         string
	stackName      string
	orgFlag        string
	cwdFlag        string

View on GitHub (pinned to 793f7b2e16)

Solutions

Use exactly one of: manual, balanced, auto (lowercase).
Check the flag value's source (env var, CI template) and print it to spot hidden whitespace or casing.
Consult `pulumi neo --help` for the accepted values.

Example fix

// before
--approval-mode AUTO
// after
--approval-mode auto

Defensive patterns

Strategy: validation

Validate before calling

func validApprovalMode(s string) bool { switch s { case "manual", "balanced", "auto": return true }; return false }
if !validApprovalMode(flagVal) { return fmt.Errorf("bad --approval-mode %q", flagVal) }

Type guard

func isApprovalMode(s string) bool { return s == "manual" || s == "balanced" || s == "auto" }

Prevention

Use lowercase enum strings exactly
Print interpolated values from env/CI variables before invoking
Define the modes as constants in scripts instead of inline literals

When it happens

Trigger: Running `pulumi neo --approval-mode Manual|AUTO|full|sudo` or any misspelled/abbreviated value; scripts with a value coming from an env var or config file that holds a non-enum string.

Common situations: Case mismatches (values must be lowercase); typos like 'manually'; older scripts using approval names from a different tool; templated CI configs interpolating wrong variables.

Related errors

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/af38aba52fc8b71f. Report an issue: GitHub.