{"record":{"id":"e9171e11d3e3b6ea","repo":"fatedier/frp","slug":"complete-client-config-error-v","errorCode":null,"errorMessage":"complete client config error: %v","messagePattern":"complete client config error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/ssh/server.go","lineNumber":115,"sourceCode":"\ts.sshConn = sshConn\n\n\taddr, extraPayload, err := s.waitForwardAddrAndExtraPayload(channels, requests, 3*time.Second)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tclientCfg, pc, helpMessage, err := s.parseClientAndProxyConfigurer(addr, extraPayload)\n\tif err != nil {\n\t\tif errors.Is(err, flag.ErrHelp) {\n\t\t\ts.writeToClient(helpMessage)\n\t\t\treturn nil\n\t\t}\n\t\ts.writeToClient(err.Error())\n\t\treturn fmt.Errorf(\"parse flags from ssh client error: %v\", err)\n\t}\n\tif err := clientCfg.Complete(); err != nil {\n\t\ts.writeToClient(fmt.Sprintf(\"failed to complete client config: %v\", err))\n\t\treturn fmt.Errorf(\"complete client config error: %v\", err)\n\t}\n\tif sshConn.Permissions != nil {\n\t\tclientCfg.User = util.EmptyOr(sshConn.Permissions.Extensions[\"user\"], clientCfg.User)\n\t}\n\tpc.Complete()\n\n\tvc, err := virtual.NewClient(virtual.ClientOptions{\n\t\tCommon: clientCfg,\n\t\tSpec: &msg.ClientSpec{\n\t\t\tType: \"ssh-tunnel\",\n\t\t\t// If ssh does not require authentication, then the virtual client needs to authenticate through a token.\n\t\t\t// Otherwise, once ssh authentication is passed, the virtual client does not need to authenticate again.\n\t\t\tAlwaysAuthPass: !s.sc.NoClientAuth,\n\t\t},\n\t\tHandleWorkConnCb: func(base *v1.ProxyBaseConfig, workConn net.Conn, m *msg.StartWorkConn) bool {\n\t\t\t// join workConn and ssh channel\n\t\t\tc, err := s.openConn(addr)\n\t\t\tif err != nil {","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/ssh/server.go#L97-L133","documentation":"Returned when v1.ClientCommonConfig.Complete() fails after the SSH payload flags were successfully parsed. Complete() fills defaults and validates the assembled client config (server address, user, TLS settings, etc.). The underlying reason is both written to the client's SSH session and wrapped in this error on the server side.","triggerScenarios":"Flags parsed but the resulting common config is inconsistent — e.g. server address derived from the connection is unusable, a transport option combination is rejected by Complete(), or an auth field is invalid. The concrete sub-error from Complete() is included after 'complete client config error: '.","commonSituations":"Passing common-config flags over SSH that conflict with the fixed server-side values (token, user, tls settings); version drift where an old ssh client sends flags that the new frps Complete() rejects; specifying options that only make sense in standalone frpc mode.","solutions":["Check the message echoed to the SSH session — it prefixes 'failed to complete client config: <reason>'.","Strip common-config flags from the ssh command; the SSH tunnel derives server/user/token from the session itself.","Keep only proxy-level flags (local address/port, remotePort, custom domains) in the SSH payload.","If you need full common config, use the frpc binary with a config file instead of the SSH tunnel path.","Verify frpc-side tooling/frps versions match when driving this programmatically."],"exampleFix":"# before\nssh v0@frps \"tcp 127.0.0.1:22 --serverAddr frps.example.com --token xxx\"\n\n# after (common config comes from the session; keep proxy flags only)\nssh v0@frps \"tcp 127.0.0.1:22 --remotePort 6000\"","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"ssh v0@host \"tcp 127.0.0.1:22 --remotePort 6000\" 2>&1 | tee /dev/stderr | grep -q \"failed to complete client config\" && echo \"fix flags: use proxy-level flags only\"","preventionTips":["Keep common-config settings out of the ssh payload; they are derived from the session.","Use the frpc binary with a config file when you need full common-config control.","Match frps and frpc/ssh-tunnel tooling versions."],"tags":["ssh","configuration","validation"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}