{"record":{"id":"aae6893a914184e9","repo":"langchain-ai/deepagents","slug":"failed-to-read-credential-file-path-exc-chec","errorCode":null,"errorMessage":"Failed to read credential file {path}: {exc}. Check the file permissions on the parent directory.","messagePattern":"Failed to read credential file (.+?): (.+?)\\. Check the file permissions on the parent directory\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"libs/code/deepagents_code/auth_store.py","lineNumber":179,"sourceCode":"    Returns:\n        The decoded JSON object, or `None` when the file is missing.\n\n    Raises:\n        RuntimeError: If the file exists but cannot be parsed or has an\n            unsupported schema version.\n    \"\"\"\n    path = auth_path()\n    try:\n        raw = path.read_text(encoding=\"utf-8\")\n        data = json.loads(raw)\n    except FileNotFoundError:\n        return None\n    except OSError as exc:\n        msg = (\n            f\"Failed to read credential file {path}: {exc}. \"\n            \"Check the file permissions on the parent directory.\"\n        )\n        raise RuntimeError(msg) from exc\n    except (UnicodeDecodeError, json.JSONDecodeError) as exc:\n        # `UnicodeDecodeError` (a `ValueError`, not an `OSError`) escapes the\n        # handler above when the file holds non-UTF-8 bytes; treat a decode\n        # failure as corruption so callers get the same `RuntimeError` hint\n        # instead of an unhandled traceback.\n        msg = (\n            f\"Failed to parse credential file {path}: {exc}. \"\n            \"Delete the file and re-add credentials via /auth if it is corrupt.\"\n        )\n        raise RuntimeError(msg) from exc\n    if not isinstance(data, dict):\n        msg = (\n            f\"Credential file {path} is not a JSON object. \"\n            \"Delete it and re-add credentials via /auth.\"\n        )\n        # `RuntimeError` (not `TypeError`) is intentional: every corruption\n        # path here surfaces the same error class so callers can render one\n        # remediation hint regardless of the specific shape problem.","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/langchain-ai/deepagents/blob/a1af029e6e73cb17c36bff823d227747b28e91e1/libs/code/deepagents_code/auth_store.py#L161-L197","documentation":"`_read_raw` wraps OSError while reading the credential file and re-raises it as a RuntimeError telling the user to check parent-directory permissions. This converts OS-level failures (missing file access, permission errors) into a consistent, actionable error for `load_credentials`, `set_stored_key`, and `delete_stored_key`.","triggerScenarios":"Reading the auth-store file fails with an OSError: restrictive file modes (chmod 000), a parent directory without read permission, the file being locked/deleted mid-read, or running under a different user/container without ownership of the credentials directory.","commonSituations":"CI containers running as non-root against a home dir mounted from the host; switching users via sudo so ~/.config ownership no longer matches; read-only or corrupted mounts.","solutions":["Fix permissions: chown -R $(whoami) ~/.config/<app> and ensure the directory is readable/writable","Check parent-directory permissions (ls -la on the credentials dir) per the error hint","If the file is corrupt/unrecoverable, delete it and re-authenticate","Run the app as the user who owns the credential file"],"exampleFix":"// before (shell)\ncat ~/.config/deepagents/credentials   # PermissionError\n// after\nsudo chown -R $(whoami) ~/.config/deepagents && chmod 700 ~/.config/deepagents","handlingStrategy":"try-catch","validationCode":"import os\ncred_dir = os.path.dirname(path)\nif not os.access(cred_dir, os.R_OK | os.X_OK):\n    raise RuntimeError(f\"no access to credentials directory: {cred_dir}\")","typeGuard":null,"tryCatchPattern":"try:\n    creds = load_credentials()\nexcept RuntimeError as exc:\n    if \"Failed to read credential file\" in str(exc):\n        logger.error(\"fix permissions on the credentials directory, then re-authenticate: %s\", exc)\n    raise","preventionTips":["chown the credentials directory to the running user and chmod 700","Avoid sudo-ing into an app that then writes credentials under the original user's home","Check container mounts aren't read-only where credentials are stored","Re-authenticate after permission fixes instead of retrying the read"],"tags":["filesystem","permissions","credentials"],"backgroundTag":"credential-file-permission-denied","analyzedSha":"a1af029e6e73cb17c36bff823d227747b28e91e1","analyzedAt":"2026-08-29T11:43:24.718Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}