{"record":{"id":"967c1f4dc0dc1bd4","repo":"paperclipai/paperclip","slug":"paperclip-decision-signing-secret-must-be-at-least","errorCode":null,"errorMessage":"PAPERCLIP_DECISION_SIGNING_SECRET must be at least ${MIN_SECRET_LENGTH} characters when set (unset it to use an auto-generated key)","messagePattern":"PAPERCLIP_DECISION_SIGNING_SECRET must be at least (.+?) characters when set \\(unset it to use an auto-generated key\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/services/decision-signing.ts","lineNumber":127,"sourceCode":"      return generated;\n    } catch (error) {\n      if (!isAlreadyExists(error)) throw error;\n      return readGeneratedSecret(keyPath);\n    }\n  } finally {\n    try {\n      unlinkSync(temporaryPath);\n    } catch (error) {\n      if (!isNotFound(error)) throw error;\n    }\n  }\n}\n\nexport function resolveDecisionSigningSecret(): string {\n  const fromEnv = process.env.PAPERCLIP_DECISION_SIGNING_SECRET?.trim();\n  if (fromEnv) {\n    if (fromEnv.length < MIN_SECRET_LENGTH) {\n      throw new Error(\n        `PAPERCLIP_DECISION_SIGNING_SECRET must be at least ${MIN_SECRET_LENGTH} characters when set (unset it to use an auto-generated key)`,\n      );\n    }\n    return fromEnv;\n  }\n  return loadOrCreateGeneratedSecret();\n}\n\n/**\n * Startup guard: resolves the signing secret once so an invalid explicit\n * PAPERCLIP_DECISION_SIGNING_SECRET fails fast and the generated key file is\n * materialized before the first decision write. A missing env var is not an\n * error — the secret is auto-generated and persisted per instance.\n */\nexport function ensureDecisionSigningSecret() {\n  resolveDecisionSigningSecret();\n}\n","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/decision-signing.ts#L109-L145","documentation":"Secret-quality guard in resolveDecisionSigningSecret: PAPERCLIP_DECISION_SIGNING_SECRET is set but shorter than the 32-character minimum. Weak HMAC keys would undermine decision-spec signing, so the operator must supply a longer value or unset the variable to use the auto-generated key file.","triggerScenarios":"Thrown at server/src/services/decision-signing.ts:127 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set PAPERCLIP_DECISION_SIGNING_SECRET to a value of at least the minimum length, or unset it to use an auto-generated key."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}