{"record":{"id":"622baafcb408403c","repo":"larksuite/cli","slug":"cannot-inspect-path-w","errorCode":null,"errorMessage":"cannot inspect path: %w","messagePattern":"cannot inspect path: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/vfs/localfileio/path.go","lineNumber":305,"sourceCode":"// file, so the target cannot exist and the write layer will surface the real\n// error with proper typing.\nfunc resolveReal(abs string) (string, error) {\n\t_, lerr := vfs.Lstat(abs)\n\tswitch {\n\tcase lerr == nil:\n\t\tresolved, err := filepath.EvalSymlinks(abs)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"cannot resolve symlinks: %w\", err)\n\t\t}\n\t\treturn resolved, nil\n\tcase os.IsNotExist(lerr) || errors.Is(lerr, syscall.ENOTDIR):\n\t\tresolved, err := resolveNearestAncestor(abs)\n\t\tif err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"cannot resolve symlinks: %w\", err)\n\t\t}\n\t\treturn resolved, nil\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"cannot inspect path: %w\", lerr)\n\t}\n}\n\nfunc resolveNearestAncestor(path string) (string, error) {\n\tvar tail []string\n\tcur := path\n\tfor {\n\t\tif _, err := vfs.Lstat(cur); err == nil {\n\t\t\treal, err := filepath.EvalSymlinks(cur)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", err\n\t\t\t}\n\t\t\tparts := append([]string{real}, tail...)\n\t\t\treturn filepath.Join(parts...), nil\n\t\t}\n\t\tparent := filepath.Dir(cur)\n\t\tif parent == cur {\n\t\t\tparts := append([]string{cur}, tail...)","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/vfs/localfileio/path.go#L287-L323","documentation":"This error is the default branch of `resolveReal`: when Lstat fails with an error other than success, not-exist, or ENOTDIR, the filesystem state of the path cannot be inspected, so the policy rejects the path instead of guessing. The wrapped errno (e.g. EACCES, EIO) is the real cause; the flag name is prefixed upstream in safePath.","triggerScenarios":"Calling SafeInputPath/SafeOutputPath with a path where a component returns EACCES (no search permission), EIO (disk/mount error), ELOOP beyond EvalSymlinks handling, or errors on a failing network filesystem.","commonSituations":"Running in a sandbox/container where the user lacks execute permission on a parent directory; corrupted or half-mounted NFS/FUSE volumes; SELinux/AppArmor denials surfacing as EACCES.","solutions":["Read the wrapped errno and fix it: for EACCES, chmod/chown the parent directories to allow traversal.","Check mount health (`dmesg`, remount) if the cause is an I/O error.","Verify no LSM (SELinux/AppArmor) policy is denying stat on the path; adjust or run outside the confined context.","Choose a different target path inside an allowed, accessible root."],"exampleFix":"// before (parent not traversable)\nlark-cli drive upload --file /root/secret/data.json\n// after\nchmod o+x /root   # or use a path your user can traverse\ncp /root/secret/data.json ~/files/ && lark-cli drive upload --file ~/files/data.json","handlingStrategy":"validation","validationCode":"// Go: pre-flight Lstat to surface the real errno early\nif _, err := os.Lstat(p); err != nil && !os.IsNotExist(err) {\n    return fmt.Errorf(\"path %q not inspectable: %w\", p, err)\n}","typeGuard":null,"tryCatchPattern":"// Match the typed cause and branch on the errno\nif _, err := localfileio.SafeInputPath(p); err != nil {\n    if cause := errors.Unwrap(errors.Unwrap(err)); cause != nil && errors.Is(cause, fs.ErrPermission) {\n        return fmt.Errorf(\"fix traversal permissions on parent directories: %w\", cause)\n    }\n    return err\n}","preventionTips":["Ensure the running user has execute permission on every directory component.","Check SELinux/AppArmor audit logs when EACCES appears without a chmod explanation.","Avoid placing command I/O on flaky network mounts; stage files locally first."],"tags":["go","filesystem","permissions","path-validation"],"backgroundTag":"path-stat-permission-denied","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}