{"record":{"id":"de18af18134f9699","repo":"larksuite/cli","slug":"registry-create-open-failed-w","errorCode":null,"errorMessage":"registry create/open failed: %w","messagePattern":"registry create/open failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/keychain/keychain_windows.go","lineNumber":164,"sourceCode":"\t}\n\tblob, err := base64.StdEncoding.DecodeString(b64)\n\tif err != nil {\n\t\treturn \"\", false\n\t}\n\tentropy := dpapiEntropy(service, account)\n\tplain, err := dpapiUnprotect(blob, entropy)\n\tif err != nil {\n\t\treturn \"\", false\n\t}\n\treturn string(plain), true\n}\n\n// registrySet stores a string value in the registry under the given service and account.\nfunc registrySet(service, account string, protected []byte) error {\n\tkeyPath := registryPathForService(service)\n\tk, _, err := registry.CreateKey(registry.CURRENT_USER, keyPath, registry.SET_VALUE)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"registry create/open failed: %w\", err)\n\t}\n\tdefer k.Close()\n\n\tb64 := base64.StdEncoding.EncodeToString(protected)\n\tif err := k.SetStringValue(valueNameForAccount(account), b64); err != nil {\n\t\treturn fmt.Errorf(\"registry set failed: %w\", err)\n\t}\n\treturn nil\n}\n\n// registryRemove deletes a value from the registry under the given service and account.\nfunc registryRemove(service, account string) error {\n\tkeyPath := registryPathForService(service)\n\tk, err := registry.OpenKey(registry.CURRENT_USER, keyPath, registry.SET_VALUE)\n\tif err != nil {\n\t\treturn nil\n\t}\n\tdefer k.Close()","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/keychain/keychain_windows.go#L146-L182","documentation":"This error wraps a failure to create or open the registry key (HKCU path derived from the service) where the keychain stores an encrypted credential. registry.CreateKey with SET_VALUE access failed, so the credential was never written. The %w preserves the underlying Windows registry error (e.g. access denied, invalid key path).","triggerScenarios":"platformSet -> registrySet: registry.CreateKey(registry.CURRENT_USER, keyPath, registry.SET_VALUE) returns an error for the service's key path.","commonSituations":"Registry virtualization/redirection issues when a 32-bit process writes under Wow6432Node-restricted paths; group policy or endpoint security software blocking HKCU writes; HKEY_CURRENT_USER not loaded (run-as service, scheduled task without profile); key path containing characters derived from a malformed service name.","solutions":["Read the wrapped cause (e.g. 'Access is denied') to determine whether it is permissions or path-related.","Run the command in a normal user session so HKCU is loaded and writable.","Check group policy / antivirus 'registry protection' rules blocking writes under HKCU\\Software.","Sanitize the service/account strings used to build the key path if they may contain illegal characters."],"exampleFix":"// before: run-as-service context without HKCU\nschtasks /run /tn backup-task  // CreateKey fails: access denied\n\n// after: run interactively as the user\nC:\\Users\\dev> lark-cli auth login","handlingStrategy":"validation","validationCode":"// Pre-check: ensure HKCU is writable and the target key path has no illegal chars\nif service != filepath.Base(service) || strings.ContainsAny(service, `\\/:*?\"<>|`) {\n    return fmt.Errorf(\"service name contains characters invalid for a registry path: %q\", service)\n}\nk, err := registry.OpenKey(registry.CURRENT_USER, `Software`, registry.SET_VALUE)\nif err != nil {\n    return fmt.Errorf(\"HKCU not writable in this session: %w\", err)\n}\nk.Close()","typeGuard":null,"tryCatchPattern":"if err := keychain.Set(service, account, secret); err != nil {\n    if strings.Contains(err.Error(), \"registry create/open failed\") {\n        return fmt.Errorf(\"cannot open registry key (run interactively, check policy): %w\", err)\n    }\n    return err\n}","preventionTips":["Run credential commands in a normal interactive user session.","Sanitize service/account names used to derive registry paths.","Whitelist the CLI's HKCU\\Software path in endpoint-security policy.","Verify HKCU is loaded when using scheduled tasks or run-as wrappers."],"tags":["windows","registry","keychain","permissions"],"backgroundTag":"registry-access-denied","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}