chenhg5/cc-connect · error

project %q probe: %w

Error message

project %q probe: %w

What it means

During runRunAsUserStartupChecks, if the isolation audit itself failed to run (o.auditErr != nil), the project is recorded as fatal with `project %q probe: %w`. Unlike the audit-fatal case, here the probe never produced results, so the environment's isolation could not be verified.

Source

Thrown at cmd/cc-connect/runas_startup.go:138

	// Log every outcome — warnings, fatals, and clean passes — so the
	// operator has a single visible record of what was checked.
	var fatals []error
	for _, o := range outcomes {
		for _, w := range o.preflight.Warnings {
			slog.Warn("run_as_user: preflight warning", "project", o.project, "message", w)
		}
		for _, f := range o.preflight.Fatal {
			slog.Error("run_as_user: preflight FATAL", "project", o.project, "error", f)
			fatals = append(fatals, fmt.Errorf("project %q preflight: %w", o.project, f))
		}
		if o.preflight.HasFatal() {
			continue
		}
		if o.auditErr != nil {
			slog.Error("run_as_user: isolation probe failed to run",
				"project", o.project, "error", o.auditErr)
			fatals = append(fatals, fmt.Errorf("project %q probe: %w", o.project, o.auditErr))
			continue
		}
		slog.Info("run_as_user: isolation audit completed",
			"project", o.project,
			"whoami", o.audit.Identity.Whoami,
			"workdir_writable", o.audit.WorkDirStatus.Writable,
			"target_paths", len(o.audit.TargetPaths),
			"cross_user_results", len(o.audit.CrossUser),
		)
		for _, f := range o.audit.Fatal {
			slog.Error("run_as_user: audit FATAL", "project", o.project, "error", f)
			fatals = append(fatals, fmt.Errorf("project %q audit: %s", o.project, f))
		}
	}

	if len(fatals) > 0 {
		return fmt.Errorf("run_as_user startup checks failed for %d project(s); see logs above", len(fatals))
	}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Find the 'run_as_user: isolation probe failed to run' log line for the wrapped root cause.
2. Verify the run-as user can execute: `sudo -u <user> sh -c 'cd <project workdir> && whoami'`.
3. Ensure the project workdir exists and is accessible to the run-as user; fix the user account/shell if the probe can't spawn.

Example fix

// before
runas_user = "svc-agent"  # no shell
// after
sudo usermod -s /bin/sh svc-agent && sudo -u svc-agent test -d /srv/myproject

sudo -u "$RUNAS_USER" sh -c 'cd "'"$PROJECT_WORKDIR"'" && whoami' || echo "probe would fail: user cannot enter workdir"

if err := runRunAsUserStartupChecks(ctx); err != nil {
    if strings.Contains(err.Error(), "probe:") {
        slog.Error("isolation probe could not run; check run-as user account/shell")
    }
    return err
}

When it happens

Trigger: The isolation probe subprocess fails before producing an audit result — e.g. it cannot spawn the run-as user context, cannot cd into the project workdir, or the probe command exits with an error.

Common situations: Run-as user lacks a valid shell or PAM entry; su/sudo misconfigured for the service context; project directory missing so the probe can't chdir; systemd service user mismatch.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• PreflightRunAsUser: RunAsUser is empty
• project %q preflight: %w
• project %q audit: %s
• run_as_user startup checks failed for %d project(s); see log
• platform %q not ready

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/ae3e95962f3932c6. Report an issue: GitHub.