{"record":{"id":"ad14bc26df0af420","repo":"paperclipai/paperclip","slug":"runner-diagnostics-path-is-not-a-real-directory","errorCode":null,"errorMessage":"runner diagnostics path is not a real directory","messagePattern":"runner diagnostics path is not a real directory","errorType":"error_code","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs","lineNumber":50,"sourceCode":"        return diagnostic;\n    }\n    let suffix = \"…[truncated]\";\n    let byte_limit = RUNNER_DIAGNOSTIC_MAX_BYTES.saturating_sub(suffix.len());\n    let boundary = diagnostic\n        .char_indices()\n        .map(|(index, _)| index)\n        .take_while(|index| *index <= byte_limit)\n        .last()\n        .unwrap_or(0);\n    diagnostic.truncate(boundary);\n    diagnostic.push_str(suffix);\n    diagnostic\n}\n\nfn verify_private_diagnostics_directory(directory: &Path) -> io::Result<()> {\n    let metadata = fs::symlink_metadata(directory)?;\n    if metadata.file_type().is_symlink() || !metadata.is_dir() {\n        return Err(io::Error::new(\n            io::ErrorKind::InvalidInput,\n            \"runner diagnostics path is not a real directory\",\n        ));\n    }\n    #[cfg(unix)]\n    if metadata.permissions().mode() & 0o077 != 0 {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"runner diagnostics directory is accessible by group or other users\",\n        ));\n    }\n    Ok(())\n}\n\nfn persist_runner_diagnostic(directory: &Path, message: &str) -> io::Result<()> {\n    verify_private_diagnostics_directory(directory)?;\n    let destination = directory.join(\"runnerd.stderr.log\");\n    let contents = bounded_redacted_diagnostic(message);","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs#L32-L68","documentation":"Guard in verify_private_diagnostics_directory (paperclip-runnerd): symlink_metadata shows the diagnostics directory path is a symlink or not a directory. The runner refuses to write diagnostics into a path that is not a real directory because symlinked targets could redirect sensitive runner diagnostics elsewhere.","triggerScenarios":"Thrown at packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs:50 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point the diagnostics directory setting at a real, non-symlinked directory","Replace the symlink with an actual directory (bind-mount or move the target) and restart runnerd","Create the directory if it does not exist before starting the daemon"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}