{"record":{"id":"11428f30d5c86550","repo":"paperclipai/paperclip","slug":"decision-signing-key-at-keypath-must-have-permi","errorCode":null,"errorMessage":"Decision signing key at ${keyPath} must have permissions 0600","messagePattern":"Decision signing key at (.+?) must have permissions 0600","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/services/decision-signing.ts","lineNumber":39,"sourceCode":"\nfunction enforceKeyFilePermissions(keyPath: string) {\n  let stats = lstatSync(keyPath);\n  if (!stats.isFile()) {\n    throw new Error(`Decision signing key at ${keyPath} must be a regular file`);\n  }\n  assertOwnedByCurrentUser(stats, `Decision signing key at ${keyPath}`);\n  if (process.platform === \"win32\") return;\n\n  const mode = stats.mode & 0o777;\n  if ((mode & 0o077) !== 0) {\n    chmodSync(keyPath, 0o600);\n    stats = lstatSync(keyPath);\n    if (!stats.isFile()) {\n      throw new Error(`Decision signing key at ${keyPath} must be a regular file`);\n    }\n    assertOwnedByCurrentUser(stats, `Decision signing key at ${keyPath}`);\n    if ((stats.mode & 0o077) !== 0) {\n      throw new Error(`Decision signing key at ${keyPath} must have permissions 0600`);\n    }\n  }\n}\n\nfunction enforceSecretsDirectoryPermissions(directoryPath: string) {\n  let stats = lstatSync(directoryPath);\n  if (!stats.isDirectory()) {\n    throw new Error(`Decision signing secrets directory at ${directoryPath} must be a directory`);\n  }\n  assertOwnedByCurrentUser(stats, `Decision signing secrets directory at ${directoryPath}`);\n  if (process.platform === \"win32\") return;\n\n  const mode = stats.mode & 0o777;\n  if ((mode & 0o077) !== 0) {\n    chmodSync(directoryPath, 0o700);\n    stats = lstatSync(directoryPath);\n    if (!stats.isDirectory()) {\n      throw new Error(`Decision signing secrets directory at ${directoryPath} must be a directory`);","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/decision-signing.ts#L21-L57","documentation":"Permission guard in enforceKeyFilePermissions: the key still had group/other bits after a best-effort chmod to 0600. Group/world-readable signing keys would let other local users forge/verify decision signatures, so startup refuses.","triggerScenarios":"Thrown at server/src/services/decision-signing.ts:39 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set permissions to 0600 on the decision signing key: chmod 0600 <keyPath>."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}