chenhg5/cc-connect · error

project %q preflight: %w

Error message

project %q preflight: %w

What it means

runRunAsUserStartupChecks aggregates per-project results for the run_as_user mode. If a project's preflight check reports a Fatal item, it is logged and wrapped as `project %q preflight: %w` into the fatals list. This means the project cannot safely start under the run-as user.

Source

Thrown at cmd/cc-connect/runas_startup.go:130

				Supervisor: supervisor,
				Runner:     runner,
			})
			outcomes[i].audit = report
			outcomes[i].auditErr = err
		}()
	}
	wg.Wait()

	// Log every outcome — warnings, fatals, and clean passes — so the
	// operator has a single visible record of what was checked.
	var fatals []error
	for _, o := range outcomes {
		for _, w := range o.preflight.Warnings {
			slog.Warn("run_as_user: preflight warning", "project", o.project, "message", w)
		}
		for _, f := range o.preflight.Fatal {
			slog.Error("run_as_user: preflight FATAL", "project", o.project, "error", f)
			fatals = append(fatals, fmt.Errorf("project %q preflight: %w", o.project, f))
		}
		if o.preflight.HasFatal() {
			continue
		}
		if o.auditErr != nil {
			slog.Error("run_as_user: isolation probe failed to run",
				"project", o.project, "error", o.auditErr)
			fatals = append(fatals, fmt.Errorf("project %q probe: %w", o.project, o.auditErr))
			continue
		}
		slog.Info("run_as_user: isolation audit completed",
			"project", o.project,
			"whoami", o.audit.Identity.Whoami,
			"workdir_writable", o.audit.WorkDirStatus.Writable,
			"target_paths", len(o.audit.TargetPaths),
			"cross_user_results", len(o.audit.CrossUser),
		)
		for _, f := range o.audit.Fatal {

View on GitHub (pinned to 4000b2338a)

Solutions

1. Read the preceding 'run_as_user: preflight FATAL' log line for the exact underlying error for that project.
2. Fix the reported condition (chmod/chown workdir, make the agent CLI executable for the run-as user).
3. Re-run startup; the error names the project so only failing projects need fixing.

Example fix

// before
sudo chown root:root /srv/myproject  # run-as user cannot write
// after
sudo chown runasuser:runasuser /srv/myproject && chmod u+wx /srv/myproject

// pre-deploy check
sudo -u "$RUNAS_USER" test -w "$PROJECT_WORKDIR" || echo "workdir not writable by $RUNAS_USER"

if err := runRunAsUserStartupChecks(ctx); err != nil {
    slog.Error("startup aborted", "err", err)
    os.Exit(1) // keep detailed FATAL lines in logs
}

When it happens

Trigger: A configured project fails its preflight (e.g. workdir not writable by the run-as user, missing binary, bad permissions) so preflight.Fatal is non-empty during startup checks.

Common situations: Run_as_user deployed with a project whose working directory is owned by root; CLI binary not executable by the service user; config path permissions too strict after hardening.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• PreflightRunAsUser: RunAsUser is empty
• read existing Agy hooks %s: %w
• kimi: read sessions dir: %w
• pi: read settings: %w
• piSession: write extension_ui_response: %w

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/f4c0d83c3c1b7bf1. Report an issue: GitHub.