{"record":{"id":"f696e84902ef994f","repo":"bytedance/deer-flow","slug":"failed-to-start-lark-authorization","errorCode":null,"errorMessage":"Failed to start Lark authorization.","messagePattern":"Failed to start Lark authorization\\.","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"backend/app/gateway/routers/integrations.py","lineNumber":379,"sourceCode":"            start_lark_auth,\n            get_effective_user_id(),\n            domains=tuple(body.domains),\n            scope=body.scope,\n            recommend=body.recommend,\n            generation=body.generation,\n        )\n        return _auth_start_to_response(result)\n    except FileNotFoundError as e:\n        raise HTTPException(status_code=404, detail=str(e))\n    except LarkFlowSupersededError as e:\n        raise HTTPException(status_code=409, detail=str(e))\n    except ValueError as e:\n        raise HTTPException(status_code=400, detail=str(e))\n    except TimeoutError as e:\n        raise HTTPException(status_code=504, detail=str(e))\n    except Exception as e:\n        logger.error(\"Failed to start Lark authorization: %s\", e, exc_info=True)\n        raise HTTPException(status_code=500, detail=\"Failed to start Lark authorization.\")\n\n\n@router.post(\"/lark/auth/complete\", response_model=LarkAuthCompleteResponse, summary=\"Complete Lark/Feishu Browser Authorization\")\nasync def complete_lark_browser_auth(request: Request, body: LarkAuthCompleteRequest, config: AppConfig = Depends(get_config)) -> LarkAuthCompleteResponse:\n    try:\n        result = await asyncio.to_thread(\n            complete_lark_auth,\n            get_effective_user_id(),\n            config,\n            device_code=body.device_code,\n            generation=body.generation,\n            wait_timeout_seconds=body.wait_timeout_seconds,\n        )\n        return _auth_complete_to_response(result, include_host_paths=await _is_admin_user(request))\n    except FileNotFoundError as e:\n        raise HTTPException(status_code=404, detail=str(e))\n    except LarkFlowSupersededError as e:\n        raise HTTPException(status_code=409, detail=str(e))","sourceCodeStart":361,"sourceCodeEnd":397,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/routers/integrations.py#L361-L397","documentation":"Generic 500 catch-all for POST /lark/auth/start (integrations.py:379). Exceptions outside FileNotFoundError/LarkFlowSupersededError/ValueError/TimeoutError — e.g. OSError from the CLI subprocess, permission errors re-hardening the credential tree in ensure_lark_cli_credential_tree, or JSON parse crashes — are logged with traceback and returned opaquely.","triggerScenarios":"lark-cli binary present but not executable by the Gateway user; the post-command credential-tree hardening failing on file permissions; corrupted JSON output crashing the parser.","commonSituations":"Wrong ownership on the managed CLI binary or credential dir, security software blocking exec, container user changes after install.","solutions":["Read the 'Failed to start Lark authorization:' traceback in Gateway logs","Check exec permissions on the managed lark-cli path for the Gateway service user","Repair ownership of the credential tree or reinstall via /lark/install","Retry after remediation; start re-issues safely"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await authStart(body); } catch (e) {\n  if (e?.response?.status === 500) captureMessage('lark auth start 500', { extra: e.response.data });\n}","preventionTips":["Smoke-test the managed lark-cli exec permissions as the Gateway user","Alert on 500 clusters from /lark/auth/start and pull Gateway tracebacks"],"tags":["lark","feishu","http-500","auth","gateway","permissions"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}