chenhg5/cc-connect · error

VerifyRunAsUserCheap: runAsUser is empty

Error message

VerifyRunAsUserCheap: runAsUser is empty

What it means

VerifyRunAsUserCheap performs fast, cheap validation that the configured run_as_user is usable via sudo (passwordless sudo -iu to run /usr/bin/true). It throws this error synchronously when the runAsUser argument is an empty string, since sudo validation cannot proceed without a target user. This is an input-invariant check before the sudo probe.

Source

Thrown at core/runas.go:237

// VerifyRunAsUserCheap runs the two cheap preflight checks that must pass
// before every spawn, not just at startup:
//
//  1. `sudo -n -iu <user> -- /usr/bin/true` must succeed — the supervisor still
//     has passwordless sudo to the target user.
//  2. `sudo -n -iu <user> -- sudo -n /usr/bin/true` must FAIL — the target user
//     cannot non-interactively escalate.
//
// Returns nil if both checks behave as expected. Results are cached for
// verifyCacheTTL keyed by runAsUser so rapid-fire messages don't pay the
// ~100ms cost per spawn. A failure evicts the cache immediately so the
// next spawn re-verifies fresh.
//
// The expensive checks (work_dir access, isolation probe) live in the
// preflight and audit packages and only run at startup / via `cc-connect
// doctor user-isolation`.
func VerifyRunAsUserCheap(ctx context.Context, runner SudoRunner, runAsUser string) error {
	if runAsUser == "" {
		return errors.New("VerifyRunAsUserCheap: runAsUser is empty")
	}
	if verifyCacheHit(runAsUser) {
		return nil
	}
	if out, err := runner.Run(ctx, "-n", "-iu", runAsUser, "--", "/usr/bin/true"); err != nil {
		verifyCacheEvict(runAsUser)
		return fmt.Errorf("passwordless sudo to user %q failed (check that your sudoers rule is present and scoped to this user): %w: %s", runAsUser, err, strings.TrimSpace(string(out)))
	}
	out, err := runner.Run(ctx, "-n", "-iu", runAsUser, "--", "sudo", "-n", "/usr/bin/true")
	if err == nil {
		verifyCacheEvict(runAsUser)
		return fmt.Errorf("target user %q can run passwordless sudo; isolation is meaningless. Remove NOPASSWD sudo for this user. Output: %s", runAsUser, strings.TrimSpace(string(out)))
	}
	verifyCacheStore(runAsUser)
	return nil
}

// verifyCacheTTL is short by design. It absorbs a burst of messages

View on GitHub (pinned to 4000b2338a)

Solutions

1. Set a non-empty run_as_user in config.toml for the project/agent.
2. Guard the call: only invoke VerifyRunAsUserCheap when run_as_user is configured (empty means the feature is off).
3. Run `cc-connect doctor user-isolation` to validate the full run_as_user setup.

Example fix

// before
if err := core.VerifyRunAsUserCheap(ctx, runner, cfg.RunAsUser); err != nil {
    return err
}
// after
if cfg.RunAsUser == "" {
    return nil // run_as_user disabled; skip sudo verification
}
if err := core.VerifyRunAsUserCheap(ctx, runner, cfg.RunAsUser); err != nil {
    return fmt.Errorf("claudecode: verify run_as_user: %w", err)
}

if runAsUser == "" {
    return nil // feature disabled, skip verification
}

if err := core.VerifyRunAsUserCheap(ctx, runner, user); err != nil {
    return fmt.Errorf("run_as_user verification failed: %w", err)
}

When it happens

Trigger: newClaudeSession calls VerifyRunAsUserCheap with runAsUser == "" — i.e. the agent/session config yielded no run_as_user value, or an empty string was passed explicitly.

Common situations: config.toml has run_as_user = "" or the key is missing while a code path still invokes the sudo validation; a migration renamed the config field leaving the value empty; programmatic construction of session options omitted RunAsUser.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• RunIsolationProbe: RunAsUser is empty
• PreflightRunAsUser: RunAsUser is empty
• project %q: target user %q can run passwordless sudo. The ru
• run_as_user is not supported on Windows
• claudeSession: run_as_user spawn refused: %w

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/121c1d27cf734bb2. Report an issue: GitHub.