paperclipai/paperclip · error · Error

Cannot seed worktree database because source local_encrypted

Error message

Cannot seed worktree database because source local_encrypted secrets key was not found at ${sourceKeyFilePath}.

What it means

Thrown by copySeededSecretsKey when the source instance uses the local_encrypted secrets provider and no inline master key is available, but the resolved key file path (PAPERCLIP_SECRETS_MASTER_KEY_FILE override or config.secrets.localEncrypted.keyFilePath) does not exist on disk. The target needs the same key to decrypt seeded secrets.

Source

Thrown at cli/src/commands/worktree.ts:1074

      encoding: "utf8",
      mode: 0o600,
    });
    try {
      chmodSync(input.targetKeyFilePath, 0o600);
    } catch {
      // best effort
    }
    return;
  }

  const sourceKeyFileOverride =
    nonEmpty(input.sourceEnvEntries.PAPERCLIP_SECRETS_MASTER_KEY_FILE) ??
    (allowProcessEnvFallback ? nonEmpty(process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE) : null);
  const sourceConfiguredKeyPath = sourceKeyFileOverride ?? input.sourceConfig.secrets.localEncrypted.keyFilePath;
  const sourceKeyFilePath = resolveRuntimeLikePath(sourceConfiguredKeyPath, input.sourceConfigPath);

  if (!existsSync(sourceKeyFilePath)) {
    throw new Error(
      `Cannot seed worktree database because source local_encrypted secrets key was not found at ${sourceKeyFilePath}.`,
    );
  }

  copyFileSync(sourceKeyFilePath, input.targetKeyFilePath);
  try {
    chmodSync(input.targetKeyFilePath, 0o600);
  } catch {
    // best effort
  }
}

async function ensureEmbeddedPostgres(dataDir: string, preferredPort: number): Promise<EmbeddedPostgresHandle> {
  const moduleName = "embedded-postgres";
  let EmbeddedPostgres: EmbeddedPostgresCtor;
  try {
    const mod = await import(moduleName);
    EmbeddedPostgres = mod.default as EmbeddedPostgresCtor;

View on GitHub (pinned to 67001ec6eb)

Solutions

1. Locate the source master key file and either place it at the configured keyFilePath or set PAPERCLIP_SECRETS_MASTER_KEY_FILE/PAPERCLIP_SECRETS_MASTER_KEY to point at it.
2. Set PAPERCLIP_SECRETS_MASTER_KEY inline in the source .env if the file cannot be restored.
3. If the key is genuinely lost, rotate secrets in the source and regenerate the key before reseeding.
4. Verify keyFilePath in source config.json resolves against the source config directory.

Example fix

# before: key file missing
# after
export PAPERCLIP_SECRETS_MASTER_KEY_FILE=/home/user/.paperclip/secrets.key

function sourceSecretsKeyResolvable(input: { sourceConfig: PaperclipConfig; sourceEnvEntries: Record<string,string>; sourceConfigPath: string; }): boolean {
  if (input.sourceConfig.secrets.provider !== 'local_encrypted') return true;
  if (nonEmpty(input.sourceEnvEntries.PAPERCLIP_SECRETS_MASTER_KEY)) return true;
  const override = nonEmpty(input.sourceEnvEntries.PAPERCLIP_SECRETS_MASTER_KEY_FILE);
  const p = resolveRuntimeLikePath(override ?? input.sourceConfig.secrets.localEncrypted.keyFilePath, input.sourceConfigPath);
  return fs.existsSync(p);
}

When it happens

Trigger: Source secrets provider is local_encrypted; no PAPERCLIP_SECRETS_MASTER_KEY env and the key file at keyFilePath (resolved relative to source config) is missing, deleted, or on a different machine; keyFilePath points to a path that was never created.

Common situations: Key file generated on a different host and not copied; keyFilePath configured as a relative path that resolves wrong against the worktree; secrets key rotation removed the old file; fresh instance that never ran a secret-encrypting operation.

Related errors

• Target config ${input.configPath} does not look like a workt
• Source instance uses postgres mode but has no connection str
• Source and target Paperclip configs are the same. Pass --fro
• Source config not found at ${sourceConfigPath}.
• Target config not found at ${configPath}.

AI-assisted analysis of paperclipai/paperclip@67001ec6eb (2026-08-12). Data as JSON: /api/errors/f2c97686f91be6f3. Report an issue: GitHub.