{"record":{"id":"8fd5a6ba16bfc337","repo":"anomalyco/sst","slug":"errprotecteddevstage","errorCode":"ErrProtectedDevStage","errorMessage":"cannot run sst dev on protected stage","messagePattern":"cannot run sst dev on protected stage","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/project/stack.go","lineNumber":121,"sourceCode":"type StackCommandEvent struct {\n\tApp     string\n\tStage   string\n\tConfig  string\n\tCommand string\n\tVersion string\n}\n\ntype Error struct {\n\tMessage string   `json:\"message\"`\n\tURN     string   `json:\"urn\"`\n\tHelp    []string `json:\"help\"`\n}\n\nvar ErrStackRunFailed = fmt.Errorf(\"stack run had errors\")\nvar ErrStageNotFound = fmt.Errorf(\"stage not found\")\nvar ErrPassphraseInvalid = fmt.Errorf(\"passphrase invalid\")\nvar ErrProtectedStage = fmt.Errorf(\"cannot remove protected stage\")\nvar ErrProtectedDevStage = fmt.Errorf(\"cannot run sst dev on protected stage\")\nvar ErrPolicyViolation = fmt.Errorf(\"policy violations detected\")\nvar ErrPolicyConfigError = fmt.Errorf(\"policy configuration error\")\n\nfunc (p *Project) ResolvePolicyPackPath(policyPath string) (string, error) {\n\tvar resolvedPath string\n\tif filepath.IsAbs(policyPath) {\n\t\tresolvedPath = policyPath\n\t} else {\n\t\tresolvedPath = filepath.Join(p.PathRoot(), policyPath)\n\t}\n\n\tif _, err := os.Stat(resolvedPath); err != nil {\n\t\treturn \"\", fmt.Errorf(\"Policy pack not found in path: %v\", resolvedPath)\n\t}\n\n\treturn resolvedPath, nil\n}\n","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/project/stack.go#L103-L139","documentation":"ErrProtectedDevStage is the sentinel error for attempts to run `sst dev` against a stage marked as protected. It is declared alongside the other stage-protection sentinels in pkg/project/stack.go to prevent live dev sessions from mutating protected (usually production) infrastructure.","triggerScenarios":"Currently declared as a package-level sentinel (pkg/project/stack.go:121) for the dev-on-protected-stage path; in this codebase no call site returns it — `sst dev` on a protected stage is rejected upstream/CLI-side before reaching Run. It fires conceptually when the dev command targets a stage with app.protect enabled.","commonSituations":"A developer points `sst dev --stage prod` at the production stage to 'debug in prod' and is blocked; local dev config accidentally inherits a protected stage name via SST_STAGE environment variable.","solutions":["Run dev against a personal stage: `sst dev --stage myname` instead of the protected stage.","Check for an SST_STAGE environment variable or CI config forcing the protected stage name and unset/override it.","If you genuinely need to debug the protected stage, use `sst diff` or read-only commands, or have an admin temporarily disable protect."],"exampleFix":"// before\nsst dev --stage prod\n// after\nsst dev --stage myname","handlingStrategy":"validation","validationCode":"// Check which stage dev will use before launching\nconst stage = process.env.SST_STAGE ?? \"\";\nconst PROTECTED = [\"prod\", \"production\", \"staging\"];\nif (PROTECTED.includes(stage)) {\n  console.error(`Refusing to run dev on protected stage '${stage}'`);\n  process.exit(1);\n}","typeGuard":"const isProtected = (stage: string, protectedList: string[]) =>\n  protectedList.includes(stage.toLowerCase());","tryCatchPattern":null,"preventionTips":["Always run `sst dev` with an explicit personal --stage instead of relying on ambient SST_STAGE.","Keep production stage names out of local shell profiles and .env files.","Audit CI/dev scripts for stage names that match protected stages.","Use read-only commands (sst diff, sst state) when inspecting protected stages."],"tags":["sst","protected-stage","dev","infrastructure"],"backgroundTag":"protected-stage-deletion-blocked","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}