config: %s.run_as_user %q contains invalid characters (allow

Error message

config: %s.run_as_user %q contains invalid characters (allowed: a-z, A-Z, 0-9, -, _, .; must start with a letter or underscore)

What it means

Validation guard in validateRunAsUser: the configured run_as_user value fails isValidRunAsUserName (allowed: a-z A-Z 0-9 - _ . and must start with a letter or underscore). Fires during config validation before the daemon will run commands as that user, because an invalid name would fail user lookup or allow injection.

Source

Thrown at config/config.go:75

		if dangerousEnvVars[strings.ToUpper(name)] {
			return fmt.Errorf("config: %s.run_as_env must not include dangerous variable %q", prefix, name)
		}
	}
	return nil
}

func validateRunAsUser(prefix, name string) error {
	if name == "" {
		return nil
	}
	if runtime.GOOS == "windows" {
		return fmt.Errorf("config: %s.run_as_user is only supported on Linux/macOS", prefix)
	}
	if name == "root" || name == "0" {
		return fmt.Errorf("config: %s.run_as_user must not be root", prefix)
	}
	if !isValidRunAsUserName(name) {
		return fmt.Errorf("config: %s.run_as_user %q contains invalid characters (allowed: a-z, A-Z, 0-9, -, _, .; must start with a letter or underscore)", prefix, name)
	}
	return nil
}

// configMu serializes read-modify-write cycles to prevent lost updates.
var configMu sync.Mutex

// ConfigPath stores the path to the config file for saving
var ConfigPath string

type Config struct {
	DataDir        string `toml:"data_dir"` // session store directory, default ~/.cc-connect
	AttachmentSend string `toml:"attachment_send"`
	// Quiet is legacy: when true and [display] does not set thinking_messages / tool_messages,
	// engines behave as if those flags were false. Per-project quiet overrides when set.
	Quiet              *bool                   `toml:"quiet,omitempty"`
	Providers          []ProviderConfig        `toml:"providers"`                      // global shared providers
	ProviderPresetsURL string                  `toml:"provider_presets_url,omitempty"` // remote JSON URL for provider presets

View on GitHub (pinned to 4000b2338a)

Solutions

Fix run_as_user in config.toml: only a-z, A-Z, 0-9, -, _, . and start with a letter or underscore
On Windows remove run_as_user entirely — it is rejected on that OS regardless of value

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at config/config.go:75 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/1899ebb079bbf207. Report an issue: GitHub.