What causes "[cloakbrowser] Failed to seed Widevine CDM hint file:" in CloakHQ/CloakBrowser?

Make the profile directory writable by the running user (chmod -R u+rwX or chown).

[cloakbrowser] Failed to seed Widevine CDM hint file:

Error message

[cloakbrowser] Failed to seed Widevine CDM hint file:

What it means

The final best-effort write of the Widevine hint file into the persistent profile failed (the caught exception is printed). Launch still proceeds; the consequence is that Widevine DRM may not be enabled for that session because Chromium never gets the CDM hint.

Solutions

Make the profile directory writable by the running user (chmod -R u+rwX <profileDir> or chown).
Free up disk space / enlarge the volume if ENOSPC.
If the volume must be read-only, mount a writable subpath for the profile or accept degraded DRM support.
Ignore the warning if DRM playback is not needed for your workload.

Example fix

# before: read-only profile volume
docker run -v /data/profile:/profile:ro ...

# after: writable profile mount
docker run -v /data/profile:/profile:rw ...

Defensive patterns

Strategy: validation

Validate before calling

import fs from 'node:fs';
fs.accessSync(profileDir, fs.constants.W_OK | fs.constants.R_OK); // throws early if profile not writable

Type guard

const isWritableDir = (dir: string): boolean => {
  try { fs.accessSync(dir, fs.constants.W_OK); return true; } catch { return false; }
};

Prevention

Ensure the profile directory is writable by the browser process user (especially in Docker). Keep profiles off read-only or network mounts. Watch disk space on long-running automation boxes; ENOSPC is a common cause.

When it happens

Trigger: writeFileSync(hintFile, content) throwing inside seedWidevineHint during launchPersistentContext: read-only profile dir, ENOSPC, EACCES, profile on a read-only mount, or the file locked by another process.

Common situations: Running the browser as a different user than the profile owner, Docker containers with read-only volumes for the profile, disk-full CI runners, or profiles on network filesystems with flushing/locking quirks.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/08eff6a46f9cac3b. Report an issue: GitHub.

Appendix: source

Thrown at js/src/widevine.ts:124

    }

    const hintDir = path.join(userDataDir, "WidevineCdm");
    fs.mkdirSync(hintDir, { recursive: true });
    const hintFile = path.join(hintDir, HINT_FILENAME);
    // cdmDir is already absolute/resolved.
    const content = JSON.stringify({ Path: cdmDir });

    try {
      if (isFile(hintFile) && fs.readFileSync(hintFile, "utf-8") === content) {
        return; // already seeded correctly
      }
    } catch {
      console.warn("[cloakbrowser] Existing Widevine hint unreadable; rewriting");
    }
    fs.writeFileSync(hintFile, content);
  } catch (e) {
    // Best-effort: never break the launch, but surface the failure.
    console.warn("[cloakbrowser] Failed to seed Widevine CDM hint file:", e);
  }
}

View on GitHub (pinned to d6bad5de26)