CloakHQ/CloakBrowser · warning

[cloakbrowser] Failed to seed Widevine CDM hint file:

Error message

[cloakbrowser] Failed to seed Widevine CDM hint file:

What it means

The final best-effort write of the Widevine hint file into the persistent profile failed (the caught exception is printed). Launch still proceeds; the consequence is that Widevine DRM may not be enabled for that session because Chromium never gets the CDM hint.

Source

Thrown at js/src/widevine.ts:124

    }

    const hintDir = path.join(userDataDir, "WidevineCdm");
    fs.mkdirSync(hintDir, { recursive: true });
    const hintFile = path.join(hintDir, HINT_FILENAME);
    // cdmDir is already absolute/resolved.
    const content = JSON.stringify({ Path: cdmDir });

    try {
      if (isFile(hintFile) && fs.readFileSync(hintFile, "utf-8") === content) {
        return; // already seeded correctly
      }
    } catch {
      console.warn("[cloakbrowser] Existing Widevine hint unreadable; rewriting");
    }
    fs.writeFileSync(hintFile, content);
  } catch (e) {
    // Best-effort: never break the launch, but surface the failure.
    console.warn("[cloakbrowser] Failed to seed Widevine CDM hint file:", e);
  }
}

View on GitHub (pinned to d6bad5de26)

Solutions

1. Make the profile directory writable by the running user (chmod -R u+rwX <profileDir> or chown).
2. Free up disk space / enlarge the volume if ENOSPC.
3. If the volume must be read-only, mount a writable subpath for the profile or accept degraded DRM support.
4. Ignore the warning if DRM playback is not needed for your workload.

Example fix

# before: read-only profile volume
docker run -v /data/profile:/profile:ro ...

# after: writable profile mount
docker run -v /data/profile:/profile:rw ...

import fs from 'node:fs';
fs.accessSync(profileDir, fs.constants.W_OK | fs.constants.R_OK); // throws early if profile not writable

const isWritableDir = (dir: string): boolean => {
  try { fs.accessSync(dir, fs.constants.W_OK); return true; } catch { return false; }
};

When it happens

Trigger: writeFileSync(hintFile, content) throwing inside seedWidevineHint during launchPersistentContext: read-only profile dir, ENOSPC, EACCES, profile on a read-only mount, or the file locked by another process.

Common situations: Running the browser as a different user than the profile owner, Docker containers with read-only volumes for the profile, disk-full CI runners, or profiles on network filesystems with flushing/locking quirks.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• [cloakbrowser] Existing Widevine hint unreadable; rewriting
• Pro download completed but binary not found at: {p}
• GeoIP resolution failed: GeoIP database is unavailable
• [cloakbrowser] CLOAKBROWSER_WIDEVINE_CDM is set but has no m

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/08eff6a46f9cac3b. Report an issue: GitHub.