googleapis/mcp-toolbox · error

cannot resolve path %q: %w

Error message

cannot resolve path %q: %w

What it means

ResolveSymlinks' call to filepath.EvalSymlinks failed with an error other than not-exist (e.g. permission denied on a traversed directory) — the path's symlink chain cannot be resolved to verify it stays within bounds.

Source

Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:81

// download destination) are resolved as deeply as the filesystem allows, and
// the missing components are appended literally.
//
// A component that exists as a symbolic link but does not resolve — a dangling
// link — is rejected rather than treated as a missing name. Creating a file at
// such a path follows the link, so accepting it on the strength of its literal
// name would reopen the very escape this function exists to close.
//
// The returned path reflects the filesystem as it was during the walk, so a
// caller that opens the path afterwards is still racing anyone able to write
// into the directories it traverses. Hard links are not detectable here at all.
// Both remain the operator's to contain with OS permissions.
func ResolveSymlinks(path string) (string, error) {
	resolved, err := filepath.EvalSymlinks(path)
	if err == nil {
		return resolved, nil
	}
	if !errors.Is(err, fs.ErrNotExist) {
		return "", fmt.Errorf("cannot resolve path %q: %w", path, err)
	}

	// Walk up to the deepest ancestor that does resolve, remembering the
	// components we stepped over so they can be reattached to it.
	var missing []string
	cur := path
	for {
		if fi, lerr := os.Lstat(cur); lerr == nil && fi.Mode()&fs.ModeSymlink != 0 {
			return "", fmt.Errorf("path %q traverses unresolvable symbolic link %q", path, cur)
		}
		parent := filepath.Dir(cur)
		if parent == cur {
			return "", fmt.Errorf("cannot resolve path %q: no existing ancestor", path)
		}
		missing = append([]string{filepath.Base(cur)}, missing...)
		cur = parent

		resolvedParent, perr := filepath.EvalSymlinks(cur)

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Check OS permissions on the directories in the path
2. Remove or fix broken filesystem entries along the path
3. Inspect the wrapped error for the exact syscall failure

When it happens

Trigger: Thrown at internal/tools/cloudstorage/cloudstoragecommon/paths.go:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/8499cd6c98239abb. Report an issue: GitHub.