{"record":{"id":"ae3e95962f3932c6","repo":"chenhg5/cc-connect","slug":"project-q-probe-w","errorCode":null,"errorMessage":"project %q probe: %w","messagePattern":"project %q probe: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cc-connect/runas_startup.go","lineNumber":138,"sourceCode":"\n\t// Log every outcome — warnings, fatals, and clean passes — so the\n\t// operator has a single visible record of what was checked.\n\tvar fatals []error\n\tfor _, o := range outcomes {\n\t\tfor _, w := range o.preflight.Warnings {\n\t\t\tslog.Warn(\"run_as_user: preflight warning\", \"project\", o.project, \"message\", w)\n\t\t}\n\t\tfor _, f := range o.preflight.Fatal {\n\t\t\tslog.Error(\"run_as_user: preflight FATAL\", \"project\", o.project, \"error\", f)\n\t\t\tfatals = append(fatals, fmt.Errorf(\"project %q preflight: %w\", o.project, f))\n\t\t}\n\t\tif o.preflight.HasFatal() {\n\t\t\tcontinue\n\t\t}\n\t\tif o.auditErr != nil {\n\t\t\tslog.Error(\"run_as_user: isolation probe failed to run\",\n\t\t\t\t\"project\", o.project, \"error\", o.auditErr)\n\t\t\tfatals = append(fatals, fmt.Errorf(\"project %q probe: %w\", o.project, o.auditErr))\n\t\t\tcontinue\n\t\t}\n\t\tslog.Info(\"run_as_user: isolation audit completed\",\n\t\t\t\"project\", o.project,\n\t\t\t\"whoami\", o.audit.Identity.Whoami,\n\t\t\t\"workdir_writable\", o.audit.WorkDirStatus.Writable,\n\t\t\t\"target_paths\", len(o.audit.TargetPaths),\n\t\t\t\"cross_user_results\", len(o.audit.CrossUser),\n\t\t)\n\t\tfor _, f := range o.audit.Fatal {\n\t\t\tslog.Error(\"run_as_user: audit FATAL\", \"project\", o.project, \"error\", f)\n\t\t\tfatals = append(fatals, fmt.Errorf(\"project %q audit: %s\", o.project, f))\n\t\t}\n\t}\n\n\tif len(fatals) > 0 {\n\t\treturn fmt.Errorf(\"run_as_user startup checks failed for %d project(s); see logs above\", len(fatals))\n\t}","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/cmd/cc-connect/runas_startup.go#L120-L156","documentation":"During runRunAsUserStartupChecks, if the isolation audit itself failed to run (o.auditErr != nil), the project is recorded as fatal with `project %q probe: %w`. Unlike the audit-fatal case, here the probe never produced results, so the environment's isolation could not be verified.","triggerScenarios":"The isolation probe subprocess fails before producing an audit result — e.g. it cannot spawn the run-as user context, cannot cd into the project workdir, or the probe command exits with an error.","commonSituations":"Run-as user lacks a valid shell or PAM entry; su/sudo misconfigured for the service context; project directory missing so the probe can't chdir; systemd service user mismatch.","solutions":["Find the 'run_as_user: isolation probe failed to run' log line for the wrapped root cause.","Verify the run-as user can execute: `sudo -u <user> sh -c 'cd <project workdir> && whoami'`.","Ensure the project workdir exists and is accessible to the run-as user; fix the user account/shell if the probe can't spawn."],"exampleFix":"// before\nrunas_user = \"svc-agent\"  # no shell\n// after\nsudo usermod -s /bin/sh svc-agent && sudo -u svc-agent test -d /srv/myproject","handlingStrategy":"validation","validationCode":"sudo -u \"$RUNAS_USER\" sh -c 'cd \"'\"$PROJECT_WORKDIR\"'\" && whoami' || echo \"probe would fail: user cannot enter workdir\"","typeGuard":null,"tryCatchPattern":"if err := runRunAsUserStartupChecks(ctx); err != nil {\n    if strings.Contains(err.Error(), \"probe:\") {\n        slog.Error(\"isolation probe could not run; check run-as user account/shell\")\n    }\n    return err\n}","preventionTips":["Give the run-as user a valid shell and ensure su/sudo rules allow non-interactive use.","Create project directories before the service starts.","Test with `sudo -u <user> -- <agent-cli> --version` after any account change."],"tags":["go","startup","isolation","probe"],"backgroundTag":"permission-denied","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}