{"record":{"id":"7bdeb1860dc0a568","repo":"JuliusBrussee/caveman","slug":"native-session-key-create-w","errorCode":null,"errorMessage":"native session key create: %w","messagePattern":"native session key create: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/internal/nativeruntime/marker.go","lineNumber":54,"sourceCode":"\tfile, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)\n\tif err == nil {\n\t\tif _, writeErr := file.Write(key); writeErr != nil {\n\t\t\t_ = file.Close()\n\t\t\t_ = os.Remove(path)\n\t\t\treturn nil, fmt.Errorf(\"native session key write: %w\", writeErr)\n\t\t}\n\t\tif syncErr := file.Sync(); syncErr != nil {\n\t\t\t_ = file.Close()\n\t\t\t_ = os.Remove(path)\n\t\t\treturn nil, fmt.Errorf(\"native session key sync: %w\", syncErr)\n\t\t}\n\t\tif closeErr := file.Close(); closeErr != nil {\n\t\t\treturn nil, fmt.Errorf(\"native session key close: %w\", closeErr)\n\t\t}\n\t\treturn key, nil\n\t}\n\tif !errors.Is(err, os.ErrExist) {\n\t\treturn nil, fmt.Errorf(\"native session key create: %w\", err)\n\t}\n\tkey, err = os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"native session key read: %w\", err)\n\t}\n\tif len(key) != sessionKeyBytes {\n\t\treturn nil, fmt.Errorf(\"native session key length = %d, want %d\", len(key), sessionKeyBytes)\n\t}\n\tif err := os.Chmod(path, 0o600); err != nil {\n\t\treturn nil, fmt.Errorf(\"native session key chmod: %w\", err)\n\t}\n\treturn key, nil\n}\n\n// SessionMarker builds model-temporary correlation context. Local proxy removes\n// valid markers byte-surgically before provider inspection or forwarding.\nfunc SessionMarker(key []byte, sessionID string) (string, error) {\n\tif len(key) != sessionKeyBytes || sessionID == \"\" || len(sessionID) > 256 {","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/proxy/internal/nativeruntime/marker.go#L36-L72","documentation":"OpenFile(O_WRONLY|O_CREAT|O_EXCL) on session.key returned an error other than os.ErrExist. That means the create itself failed for a non-race reason: permission denied on the runtime directory, read-only filesystem, or the path existing as a directory. (The EEXIST case is the normal concurrent-startup path and falls through to reading the existing key.)","triggerScenarios":"runtime dir is 0700 owned by another user; filesystem mounted read-only; <home>/runtime/session.key exists as a directory; SELinux/AppArmor denying writes.","commonSituations":"Running the binary as a different user than the one who first created ~/.caveman; hardened or read-only root filesystems.","solutions":["Fix ownership: chown -R runninguser <home>","If the path is a directory, remove it so a regular key file can be created","Remount the volume read-write or point home at writable storage","Check MAC (SELinux/AppArmor) denials in the audit log"],"exampleFix":"# before\n~/.caveman/runtime owned by root, running as user -> Error[1072]\n\n# after\nsudo chown -R $(id -un):$(id -gn) ~/.caveman","handlingStrategy":"validation","validationCode":"func canCreateKey(home string) bool {\n    dir := filepath.Join(home, \"runtime\")\n    probe, err := os.CreateTemp(dir, \".probe-*\")\n    if err != nil { return false }\n    os.Remove(probe.Name())\n    return true\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run all caveman processes (CLI adapters, proxy, runtime) as the same user","Pre-provision <home>/runtime 0700 owned by that user","Check SELinux/AppArmor denials when running under system units"],"tags":["filesystem","permissions","nativeruntime","session-key"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}