{"record":{"id":"fc0f52fffd9de7bc","repo":"PrefectHQ/fastmcp","slug":"could-not-restrict-access-to-cli-state","errorCode":null,"errorMessage":"Could not restrict access to CLI state","messagePattern":"Could not restrict access to CLI state","errorType":"exception","errorClass":"StateFileError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/cli/deploy/state.py","lineNumber":74,"sourceCode":"\ndef _restrict_windows_access(path: Path) -> None:\n    try:\n        subprocess.run(\n            [\n                \"powershell.exe\",\n                \"-NoLogo\",\n                \"-NoProfile\",\n                \"-NonInteractive\",\n                \"-Command\",\n                _WINDOWS_ACL_SCRIPT,\n            ],\n            check=True,\n            capture_output=True,\n            text=True,\n            env={**os.environ, \"FASTMCP_STATE_PATH\": str(path)},\n        )\n    except (OSError, subprocess.SubprocessError) as exc:\n        raise StateFileError(\"Could not restrict access to CLI state\") from exc\n\n\ndef _restrict_access(path: Path, *, directory: bool = False) -> None:\n    try:\n        if os.name == \"nt\":\n            _restrict_windows_access(path)\n        else:\n            path.chmod(0o700 if directory else 0o600)\n    except OSError as exc:\n        raise StateFileError(\"Could not restrict access to CLI state\") from exc\n\n\ndef _prepare_directory(path: Path) -> None:\n    try:\n        path.mkdir(parents=True, exist_ok=True)\n    except OSError as exc:\n        raise StateFileError(\"Could not create the CLI state directory\") from exc\n    _restrict_access(path, directory=True)","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/cli/deploy/state.py#L56-L92","documentation":"StateFileError raised by _restrict_windows_access when the subprocess invoked to apply Windows ACLs to the CLI state path fails (the icacls-style helper exits non-zero or cannot be spawned). The CLI cannot secure the state file/directory, so it refuses to continue rather than leaving credentials readable. The original OSError or SubprocessError is chained as __cause__.","triggerScenarios":"On Windows, any code path that restricts state access (via _restrict_access) when the ACL-modification subprocess raises OSError (spawn failure) or subprocess.SubprocessError (non-zero exit, timeout), e.g. test_windows_acl_replaces_the_existing_access_list exercises this path.","commonSituations":"icacls.exe missing from PATH or a broken Windows installation; insufficient privileges to change ACLs; antivirus/EDR blocking the subprocess; disk or permission errors on the state directory; FASTMCP_STATE_PATH pointing to an invalid location.","solutions":["Run the terminal as a user with rights over the state directory (or as administrator once to repair ACLs)","Verify the ACL utility (icacls) is present and runnable: icacls /? in the same shell","Check antivirus/EDR logs for blocked subprocesses and allowlist it","Delete the corrupted state directory and let the CLI recreate it","Read the chained exception (__cause__) output for the actual subprocess stderr"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"import shutil, os\nstate_dir = Path(os.environ.get(\"FASTMCP_STATE_PATH\", \"~/.fastmcp/state\"))\nif os.name == \"nt\" and shutil.which(\"icacls\") is None:\n    raise RuntimeError(\"icacls unavailable; cannot secure CLI state\")","typeGuard":null,"tryCatchPattern":"try:\n    restrict_access(path)\nexcept StateFileError as exc:\n    print(f\"Fix Windows ACLs on {path}: {exc.__cause__}\")\n    raise","preventionTips":["Keep icacls on PATH and Windows unmodified (no stripped system utilities)","Run CLI commands under an account that owns the state directory","Allowlist the ACL helper in antivirus/EDR software","Store FASTMCP_STATE_PATH on a local NTFS volume"],"tags":["windows","permissions","filesystem","subprocess"],"backgroundTag":"file-permission-denied","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}