{"record":{"id":"da8f426af39a1504","repo":"larksuite/cli","slug":"failed-to-stat-proxy-plugin-config-q-w","errorCode":null,"errorMessage":"failed to stat proxy plugin config %q: %w","messagePattern":"failed to stat proxy plugin config %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/config.go","lineNumber":90,"sourceCode":"\t\tcfg, hasEnv, err := loadFromEnv()\n\t\tif err != nil {\n\t\t\tloadErr = err\n\t\t\treturn\n\t\t}\n\n\t\tp := Path()\n\t\tif _, err := vfs.Stat(p); err != nil {\n\t\t\tif errors.Is(err, os.ErrNotExist) {\n\t\t\t\t// No file: return env-only config (if any), else nil.\n\t\t\t\tif hasEnv {\n\t\t\t\t\tloadCfg = cfg\n\t\t\t\t} else {\n\t\t\t\t\tloadCfg = nil\n\t\t\t\t}\n\t\t\t\tloadErr = nil\n\t\t\t\treturn\n\t\t\t}\n\t\t\tloadErr = fmt.Errorf(\"failed to stat proxy plugin config %q: %w\", p, err)\n\t\t\treturn\n\t\t}\n\t\t// Security hardening: this config dictates where ALL outbound CLI traffic\n\t\t// egresses and which extra CA is trusted, so a file another local user or\n\t\t// process can tamper with (symlink, foreign owner, group/world-writable)\n\t\t// could redirect credential traffic. Audit it the same way the CA file is.\n\t\tsafePath, err := binding.AssertSecurePath(binding.AuditParams{\n\t\t\tTargetPath:            p,\n\t\t\tLabel:                 ConfigFileName,\n\t\t\tAllowReadableByOthers: true, // config is not a secret; only writability/owner/symlink matter\n\t\t})\n\t\tif err != nil {\n\t\t\tloadErr = fmt.Errorf(\"unsafe proxy plugin config %q: %w\", p, err)\n\t\t\treturn\n\t\t}\n\t\tb, err := vfs.ReadFile(safePath)\n\t\tif err != nil {\n\t\t\tloadErr = fmt.Errorf(\"failed to read proxy plugin config %q: %w\", p, err)","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/config.go#L72-L108","documentation":"This error comes from transport.Load (internal/transport/config.go) when vfs.Stat on the proxy plugin config file (~/.lark-cli/proxy_config.json) fails with an error other than 'not exists'. Load is a one-shot cached loader that decides how all outbound CLI traffic is routed (proxy address and trusted CA), so it must be able to stat this file before auditing its safety. The wrapped err preserves the OS-level cause (e.g. permission denied, ELOOP).","triggerScenarios":"The config file path exists per directory listing but Stat fails: permission denied on the file or an ancestor directory, too many symlinks (ELOOP), an I/O error, or a path whose parent is not readable/searchable. It is NOT raised when the file simply does not exist (that returns env-only config).","commonSituations":"A user or process hardened ~/.lark-cli with overly restrictive permissions so another account cannot even stat the file; running the CLI under a different user/service account than the one that created the config; a symlink loop left by a misconfigured dotfile manager (stow/chezmoi); filesystem errors on a network-mounted home directory.","solutions":["Inspect the wrapped OS error to identify the exact cause (permission, loop, I/O)","Fix permissions: chmod/chown ~/.lark-cli and proxy_config.json so your running user can stat it","Check for symlink loops: ls -la the file and run file on it; replace a broken symlink with a real file or correct target","As a last resort, delete the unusable config file (Load treats a missing file as env-only config) and rely on proxy env vars"],"exampleFix":"// before\nls -la ~/.lark-cli/proxy_config.json -> Permission denied\n\n// after\nchmod u+rx ~/.lark-cli && chmod u+r ~/.lark-cli/proxy_config.json","handlingStrategy":"validation","validationCode":"p := filepath.Join(core.GetConfigDir(), transport.ConfigFileName)\nif _, err := os.Stat(p); err != nil && !errors.Is(err, os.ErrNotExist) {\n    return fmt.Errorf(\"proxy config unusable, fix before running CLI: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"cfg, err := transport.Load()\nif err != nil {\n    var pe *fs.PathError\n    if errors.As(err, &pe) && pe.Op == \"stat\" {\n        log.Printf(\"cannot stat %s: %v — fix perms/symlinks or delete the file\", pe.Path, pe.Err)\n    }\n}","preventionTips":["Never chmod 000 or restrict ~/.lark-cli below user search/read for your own account","Avoid symlink loops from dotfile managers; stow real files or use hardlinks where allowed","Run the CLI as the same user that owns the config","Keep home directories on reliable local filesystems, not flaky network mounts"],"tags":["filesystem","proxy-config","stat","permissions"],"backgroundTag":"config-file-unreadable","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}