{"record":{"id":"affbc411731f7f35","repo":"paperclipai/paperclip","slug":"decision-signing-secrets-directory-at-directoryp","errorCode":null,"errorMessage":"Decision signing secrets directory at ${directoryPath} must be a directory","messagePattern":"Decision signing secrets directory at (.+?) must be a directory","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/services/decision-signing.ts","lineNumber":47,"sourceCode":"\n  const mode = stats.mode & 0o777;\n  if ((mode & 0o077) !== 0) {\n    chmodSync(keyPath, 0o600);\n    stats = lstatSync(keyPath);\n    if (!stats.isFile()) {\n      throw new Error(`Decision signing key at ${keyPath} must be a regular file`);\n    }\n    assertOwnedByCurrentUser(stats, `Decision signing key at ${keyPath}`);\n    if ((stats.mode & 0o077) !== 0) {\n      throw new Error(`Decision signing key at ${keyPath} must have permissions 0600`);\n    }\n  }\n}\n\nfunction enforceSecretsDirectoryPermissions(directoryPath: string) {\n  let stats = lstatSync(directoryPath);\n  if (!stats.isDirectory()) {\n    throw new Error(`Decision signing secrets directory at ${directoryPath} must be a directory`);\n  }\n  assertOwnedByCurrentUser(stats, `Decision signing secrets directory at ${directoryPath}`);\n  if (process.platform === \"win32\") return;\n\n  const mode = stats.mode & 0o777;\n  if ((mode & 0o077) !== 0) {\n    chmodSync(directoryPath, 0o700);\n    stats = lstatSync(directoryPath);\n    if (!stats.isDirectory()) {\n      throw new Error(`Decision signing secrets directory at ${directoryPath} must be a directory`);\n    }\n    assertOwnedByCurrentUser(stats, `Decision signing secrets directory at ${directoryPath}`);\n    if ((stats.mode & 0o077) !== 0) {\n      throw new Error(`Decision signing secrets directory at ${directoryPath} must have permissions 0700`);\n    }\n  }\n}\n","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/decision-signing.ts#L29-L65","documentation":"Filetype guard in enforceSecretsDirectoryPermissions: lstat shows the secrets directory path is not actually a directory. The directory that must hold the decision-signing key (and other secrets) cannot enforce its protection model on a non-directory.","triggerScenarios":"Thrown at server/src/services/decision-signing.ts:47 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the decision signing secrets path is a directory; create it or fix the path."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}