anomalyco/sst · error

Policy pack not found in path: %v

Error message

Policy pack not found in path: %v

What it means

ResolvePolicyPackPath wraps os.Stat failures into the message "Policy pack not found in path: <resolvedPath>". It is raised when the policy pack supplied to the run cannot be found on the filesystem after path resolution: absolute paths are used verbatim, relative paths are joined against the project root (p.PathRoot()).

Source

Thrown at pkg/project/stack.go:134

var ErrStackRunFailed = fmt.Errorf("stack run had errors")
var ErrStageNotFound = fmt.Errorf("stage not found")
var ErrPassphraseInvalid = fmt.Errorf("passphrase invalid")
var ErrProtectedStage = fmt.Errorf("cannot remove protected stage")
var ErrProtectedDevStage = fmt.Errorf("cannot run sst dev on protected stage")
var ErrPolicyViolation = fmt.Errorf("policy violations detected")
var ErrPolicyConfigError = fmt.Errorf("policy configuration error")

func (p *Project) ResolvePolicyPackPath(policyPath string) (string, error) {
	var resolvedPath string
	if filepath.IsAbs(policyPath) {
		resolvedPath = policyPath
	} else {
		resolvedPath = filepath.Join(p.PathRoot(), policyPath)
	}

	if _, err := os.Stat(resolvedPath); err != nil {
		return "", fmt.Errorf("Policy pack not found in path: %v", resolvedPath)
	}

	return resolvedPath, nil
}

func (p *Project) Lock(command string) (*provider.Update, error) {
	return provider.Lock(p.home, p.Version(), command, p.app.Name, p.app.Stage)
}

func (s *Project) Unlock() error {
	return provider.Unlock(s.home, s.version, s.app.Name, s.app.Stage)
}

func (s *Project) ForceUnlock() error {
	return provider.ForceUnlock(s.home, s.version, s.app.Name, s.app.Stage)
}

func getNotNilFields(v interface{}) []interface{} {

View on GitHub (pinned to a0bd20f762)

Solutions

1. Pass an absolute path to --policy-path to bypass project-root joining, or fix the relative path so it resolves under the project root.
2. Create/restore the policy pack directory at the expected location (e.g. copy it in or un-gitignore it) and verify with `ls <resolved path>`.
3. Check file permissions on the pack directory so the user running sst can stat/read it.
4. Remove the --policy-path flag if no policy enforcement is intended for this run.

Example fix

// before
policyPath = "pack"            // resolves to <projectRoot>/pack, which doesn't exist
// after
policyPath = "/abs/path/to/policies/pack" // absolute, verified to exist

// Go: validate the policy path exactly as ResolvePolicyPackPath does, before calling Run
resolved := policyPath
if !filepath.IsAbs(resolved) {
    resolved = filepath.Join(projectRoot, resolved)
}
if _, err := os.Stat(resolved); err != nil {
    return fmt.Errorf("policy pack not found: %s", resolved)
}

resolvedPath, err := p.ResolvePolicyPackPath(input.PolicyPath)
if err != nil {
    // message includes the resolved path that was not found
    return fmt.Errorf("fix --policy-path: %w", err)
}
input.PolicyPath = resolvedPath
return p.Run(ctx, input)

When it happens

Trigger: Project.Run passes input.PolicyPath to ResolvePolicyPackPath; os.Stat(resolvedPath) returns an error because the directory does not exist or is inaccessible (pkg/project/stack.go:133-135). Triggered by `sst deploy/remove --policy-path <bad path>` or a policyPath set in the StackInput.

Common situations: Typo in the policy path; pack lives outside the repo while a relative path was given; running the CLI from a checkout where the policies folder was never committed (gitignored); permissions issue after cloning as another user.

Related errors

• ErrPolicyConfigError
• Invalid function definition for the "${name}" Function
• Cannot access `nodes.loadBalancer` when no public ports are
• You must provide the ports to expose via "loadBalancer.rules
• You must provide a container name in "loadBalancer.rules" wh

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/0564b8e2424d097b. Report an issue: GitHub.