{"record":{"id":"6f5d7481de7e234d","repo":"nanocoai/nanoclaw","slug":"failed-to-chmod-ncl-socket-continuing","errorCode":null,"errorMessage":"Failed to chmod ncl socket (continuing)","messagePattern":"Failed to chmod ncl socket \\(continuing\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/cli/socket-server.ts","lineNumber":40,"sourceCode":"  // file behind, and net.createServer refuses to bind to an existing path.\n  try {\n    fs.unlinkSync(socketPath);\n  } catch (err) {\n    const e = err as NodeJS.ErrnoException;\n    if (e.code !== 'ENOENT') {\n      log.warn('Failed to unlink stale ncl socket (will try to bind anyway)', { socketPath, err });\n    }\n  }\n\n  const s = net.createServer((conn) => handleConnection(conn));\n  server = s;\n  await new Promise<void>((resolve, reject) => {\n    s.once('error', reject);\n    s.listen(socketPath, () => {\n      try {\n        fs.chmodSync(socketPath, 0o600);\n      } catch (err) {\n        log.warn('Failed to chmod ncl socket (continuing)', { socketPath, err });\n      }\n      log.info('ncl CLI server listening', { socketPath });\n      resolve();\n    });\n  });\n}\n\nexport async function stopCliServer(): Promise<void> {\n  if (!server) return;\n  const s = server;\n  server = null;\n  await new Promise<void>((resolve) => s.close(() => resolve()));\n}\n\nfunction handleConnection(conn: net.Socket): void {\n  let buffer = '';\n  conn.on('data', (chunk) => {\n    buffer += chunk.toString('utf8');","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/nanocoai/nanoclaw/blob/294ef2aee85218b23ad30eda9dfe10e590b54a8c/src/cli/socket-server.ts#L22-L58","documentation":"The ncl Unix socket server started listening but could not chmod the socket file to 0600. The server deliberately continues (the socket works), but the restrictive permission could not be applied, so the socket may be accessible by other local users.","triggerScenarios":"`fs.chmodSync(socketPath, 0o600)` fails — e.g. the socket path lives on a filesystem that doesn't support chmod on sockets, the file was replaced concurrently, or the process lacks permission on the containing directory.","commonSituations":"Non-standard TMPDIR/socket dir mounted with odd permissions, containers sharing the socket volume, or another ncl server instance racing to bind the same path.","solutions":["Check the socketPath in the log line and its parent directory permissions (`ls -ld`Manually `chmod 600 <socketPath>` if exposure matters","Ensure only one host instance runs: `pgrep -f nanoclaw`","If in a container/odd fs, move the socket dir to a normal local path"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"import fs from 'node:fs';\nconst mode = fs.statSync(socketPath).mode & 0o777;\nif (mode !== 0o600) fs.chmodSync(socketPath, 0o600);","typeGuard":null,"tryCatchPattern":"try { fs.chmodSync(socketPath, 0o600); } catch { /* non-fatal; check dir perms */ }","preventionTips":["Keep the socket dir on a local filesystem owned by the service user","Avoid sharing the socket path between instances","Monitor for the warning at startup and fix dir ownership"],"tags":["ncl","unix-socket","permissions","startup"],"backgroundTag":"socket-permission-chmod-failed","analyzedSha":"294ef2aee85218b23ad30eda9dfe10e590b54a8c","analyzedAt":"2026-08-28T13:59:10.357Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}