{"record":{"id":"f2c97686f91be6f3","repo":"paperclipai/paperclip","slug":"cannot-seed-worktree-database-because-source-local","errorCode":null,"errorMessage":"Cannot seed worktree database because source local_encrypted secrets key was not found at ${sourceKeyFilePath}.","messagePattern":"Cannot seed worktree database because source local_encrypted secrets key was not found at (.+?)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/src/commands/worktree.ts","lineNumber":1074,"sourceCode":"      encoding: \"utf8\",\n      mode: 0o600,\n    });\n    try {\n      chmodSync(input.targetKeyFilePath, 0o600);\n    } catch {\n      // best effort\n    }\n    return;\n  }\n\n  const sourceKeyFileOverride =\n    nonEmpty(input.sourceEnvEntries.PAPERCLIP_SECRETS_MASTER_KEY_FILE) ??\n    (allowProcessEnvFallback ? nonEmpty(process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE) : null);\n  const sourceConfiguredKeyPath = sourceKeyFileOverride ?? input.sourceConfig.secrets.localEncrypted.keyFilePath;\n  const sourceKeyFilePath = resolveRuntimeLikePath(sourceConfiguredKeyPath, input.sourceConfigPath);\n\n  if (!existsSync(sourceKeyFilePath)) {\n    throw new Error(\n      `Cannot seed worktree database because source local_encrypted secrets key was not found at ${sourceKeyFilePath}.`,\n    );\n  }\n\n  copyFileSync(sourceKeyFilePath, input.targetKeyFilePath);\n  try {\n    chmodSync(input.targetKeyFilePath, 0o600);\n  } catch {\n    // best effort\n  }\n}\n\nasync function ensureEmbeddedPostgres(dataDir: string, preferredPort: number): Promise<EmbeddedPostgresHandle> {\n  const moduleName = \"embedded-postgres\";\n  let EmbeddedPostgres: EmbeddedPostgresCtor;\n  try {\n    const mod = await import(moduleName);\n    EmbeddedPostgres = mod.default as EmbeddedPostgresCtor;","sourceCodeStart":1056,"sourceCodeEnd":1092,"githubUrl":"https://github.com/paperclipai/paperclip/blob/67001ec6eb96ae601aa27bc91d9b2415d665334a/cli/src/commands/worktree.ts#L1056-L1092","documentation":"Thrown by copySeededSecretsKey when the source instance uses the local_encrypted secrets provider and no inline master key is available, but the resolved key file path (PAPERCLIP_SECRETS_MASTER_KEY_FILE override or config.secrets.localEncrypted.keyFilePath) does not exist on disk. The target needs the same key to decrypt seeded secrets.","triggerScenarios":"Source secrets provider is local_encrypted; no PAPERCLIP_SECRETS_MASTER_KEY env and the key file at keyFilePath (resolved relative to source config) is missing, deleted, or on a different machine; keyFilePath points to a path that was never created.","commonSituations":"Key file generated on a different host and not copied; keyFilePath configured as a relative path that resolves wrong against the worktree; secrets key rotation removed the old file; fresh instance that never ran a secret-encrypting operation.","solutions":["Locate the source master key file and either place it at the configured keyFilePath or set PAPERCLIP_SECRETS_MASTER_KEY_FILE/PAPERCLIP_SECRETS_MASTER_KEY to point at it.","Set PAPERCLIP_SECRETS_MASTER_KEY inline in the source .env if the file cannot be restored.","If the key is genuinely lost, rotate secrets in the source and regenerate the key before reseeding.","Verify keyFilePath in source config.json resolves against the source config directory."],"exampleFix":"# before: key file missing\n# after\nexport PAPERCLIP_SECRETS_MASTER_KEY_FILE=/home/user/.paperclip/secrets.key","handlingStrategy":"validation","validationCode":"function sourceSecretsKeyResolvable(input: { sourceConfig: PaperclipConfig; sourceEnvEntries: Record<string,string>; sourceConfigPath: string; }): boolean {\n  if (input.sourceConfig.secrets.provider !== 'local_encrypted') return true;\n  if (nonEmpty(input.sourceEnvEntries.PAPERCLIP_SECRETS_MASTER_KEY)) return true;\n  const override = nonEmpty(input.sourceEnvEntries.PAPERCLIP_SECRETS_MASTER_KEY_FILE);\n  const p = resolveRuntimeLikePath(override ?? input.sourceConfig.secrets.localEncrypted.keyFilePath, input.sourceConfigPath);\n  return fs.existsSync(p);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the master key file on the same host as the source instance.","Set PAPERCLIP_SECRETS_MASTER_KEY_FILE to an absolute path.","Back up the master key alongside config backups."],"tags":["secrets","encryption","config","reseed","filesystem"],"backgroundTag":null,"analyzedSha":"67001ec6eb96ae601aa27bc91d9b2415d665334a","analyzedAt":"2026-08-12T12:05:45.408Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}