nanocoai/nanoclaw · warning

Failed to chmod ncl socket (continuing)

Error message

Failed to chmod ncl socket (continuing)

What it means

The ncl Unix socket server started listening but could not chmod the socket file to 0600. The server deliberately continues (the socket works), but the restrictive permission could not be applied, so the socket may be accessible by other local users.

Source

Thrown at src/cli/socket-server.ts:40

  // file behind, and net.createServer refuses to bind to an existing path.
  try {
    fs.unlinkSync(socketPath);
  } catch (err) {
    const e = err as NodeJS.ErrnoException;
    if (e.code !== 'ENOENT') {
      log.warn('Failed to unlink stale ncl socket (will try to bind anyway)', { socketPath, err });
    }
  }

  const s = net.createServer((conn) => handleConnection(conn));
  server = s;
  await new Promise<void>((resolve, reject) => {
    s.once('error', reject);
    s.listen(socketPath, () => {
      try {
        fs.chmodSync(socketPath, 0o600);
      } catch (err) {
        log.warn('Failed to chmod ncl socket (continuing)', { socketPath, err });
      }
      log.info('ncl CLI server listening', { socketPath });
      resolve();
    });
  });
}

export async function stopCliServer(): Promise<void> {
  if (!server) return;
  const s = server;
  server = null;
  await new Promise<void>((resolve) => s.close(() => resolve()));
}

function handleConnection(conn: net.Socket): void {
  let buffer = '';
  conn.on('data', (chunk) => {
    buffer += chunk.toString('utf8');

View on GitHub (pinned to 294ef2aee8)

Solutions

1. Check the socketPath in the log line and its parent directory permissions (`ls -ld`Manually `chmod 600 <socketPath>` if exposure matters
2. Ensure only one host instance runs: `pgrep -f nanoclaw`
3. If in a container/odd fs, move the socket dir to a normal local path

import fs from 'node:fs';
const mode = fs.statSync(socketPath).mode & 0o777;
if (mode !== 0o600) fs.chmodSync(socketPath, 0o600);

try { fs.chmodSync(socketPath, 0o600); } catch { /* non-fatal; check dir perms */ }

When it happens

Trigger: `fs.chmodSync(socketPath, 0o600)` fails — e.g. the socket path lives on a filesystem that doesn't support chmod on sockets, the file was replaced concurrently, or the process lacks permission on the containing directory.

Common situations: Non-standard TMPDIR/socket dir mounted with odd permissions, containers sharing the socket volume, or another ncl server instance racing to bind the same path.

Related errors

• ncl CLI server connection error
• Failed to write ncl CLI response
• Provide --apt <pkg> or --npm <pkg>
• Provide --host <host-path> and --container <container-path>
• --user is required

AI-assisted analysis of nanocoai/nanoclaw@294ef2aee8 (2026-08-28). Data as JSON: /api/errors/6f5d7481de7e234d. Report an issue: GitHub.