paperclipai/paperclip · error · io::Error

runner diagnostics directory is accessible by group or other

Error message

runner diagnostics directory is accessible by group or other users

What it means

Guard in verify_private_diagnostics_directory (unix branch): the diagnostics directory's permission mode has group or other bits set (mode & 0o077 != 0). Runner diagnostics can contain sensitive run data, so the directory must be owner-private; the error fires when the directory is readable or writable by group/other users.

Source

Thrown at packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs:57

        .take_while(|index| *index <= byte_limit)
        .last()
        .unwrap_or(0);
    diagnostic.truncate(boundary);
    diagnostic.push_str(suffix);
    diagnostic
}

fn verify_private_diagnostics_directory(directory: &Path) -> io::Result<()> {
    let metadata = fs::symlink_metadata(directory)?;
    if metadata.file_type().is_symlink() || !metadata.is_dir() {
        return Err(io::Error::new(
            io::ErrorKind::InvalidInput,
            "runner diagnostics path is not a real directory",
        ));
    }
    #[cfg(unix)]
    if metadata.permissions().mode() & 0o077 != 0 {
        return Err(io::Error::new(
            io::ErrorKind::PermissionDenied,
            "runner diagnostics directory is accessible by group or other users",
        ));
    }
    Ok(())
}

fn persist_runner_diagnostic(directory: &Path, message: &str) -> io::Result<()> {
    verify_private_diagnostics_directory(directory)?;
    let destination = directory.join("runnerd.stderr.log");
    let contents = bounded_redacted_diagnostic(message);
    let process_id = std::process::id();
    for attempt in 0..RUNNER_DIAGNOSTIC_TEMP_ATTEMPTS {
        let temporary = directory.join(format!(".runnerd.stderr.log.{process_id}.{attempt}.tmp"));
        let mut options = OpenOptions::new();
        options.write(true).create_new(true);
        #[cfg(unix)]
        options.mode(0o600);

View on GitHub (pinned to 01ad858492)

Solutions

1. Run `chmod 700 <diagnostics-dir>` to strip group/other permissions
2. Ensure umask or provisioning tooling is not creating the directory with permissive modes
3. Restart paperclip-runnerd after fixing the mode

When it happens

Trigger: Thrown at packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs:57 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/2ed68a0c6dc95f7a. Report an issue: GitHub.