There was an error using a custom RC auth function, blocking

Error message

There was an error using a custom RC auth function, blocking the remote command. Error: {e}

What it means

A custom remote-control authorization function raised an exception while vetting a command; kitty blocks the command (fail-closed) and logs the error plus a traceback.

Source

Thrown at kitty/remote_control.py:163

                self.command_patterns.append(fnmatch_pattern(item))

    def is_cmd_allowed(self, pcmd: dict[str, Any], window: Optional['Window'], from_socket: bool, extra_data: dict[str, Any]) -> bool:
        cmd_name = pcmd.get('cmd')
        if not cmd_name:
            return False
        if not self.function_checkers and not self.command_patterns:
            return True
        for x in self.command_patterns:
            if x.match(cmd_name) is not None:
                return True
        for f in self.function_checkers:
            try:
                ret = f(pcmd, window, from_socket, extra_data)
            except Exception as e:
                import traceback

                traceback.print_exc()
                log_error(f'There was an error using a custom RC auth function, blocking the remote command. Error: {e}')
                ret = False
            if ret is not None:
                return ret
        return False


@lru_cache(maxsize=256)
def password_authorizer(auth_items: frozenset[str]) -> PasswordAuthorizer:
    return PasswordAuthorizer(auth_items)


user_password_allowed: dict[str, bool] = {}


def is_cmd_allowed(pcmd: dict[str, Any], window: Optional['Window'], from_socket: bool, extra_data: dict[str, Any]) -> bool | None:
    sid = pcmd.get('stream_id', '')
    if sid and active_streams.get(sid, '') == pcmd['cmd']:
        return True

View on GitHub (pinned to 6d5d0c4406)

Solutions

Read the printed traceback in kitty's log to find the failing line in your auth function
Make the callback defensive: use pcmd.get(...), wrap risky checks in try/except and return explicit False
Return None (not an exception) to let other checks run, or True/False to decide

Example fix

# before
def is_cmd_allowed(pcmd, window, from_socket, extra_data):
    return pcmd['cmd'] in ALLOWED

# after
def is_cmd_allowed(pcmd, window, from_socket, extra_data):
    return pcmd.get('cmd') in ALLOWED

Defensive patterns

Strategy: try-catch

Try / catch

def is_cmd_allowed(pcmd, window, from_socket, extra_data):
    try:
        return check(pcmd)
    except Exception:
        return False  # fail closed, kitty blocks the command

Prevention

Never assume fields exist: use pcmd.get(...)
Keep auth callbacks pure and side-effect free so they can't raise on I/O

When it happens

Trigger: The user-configured is_cmd_allowed callback raises any exception during is_cmd_allowed, so ret is forced to False.

Common situations: Auth script bugs: KeyError on unexpected pcmd fields, attribute errors on window objects across kitty versions, or network calls in the auth function failing.

Related errors

AI-assisted analysis of kovidgoyal/kitty@6d5d0c4406 (2026-08-27). Data as JSON: /api/errors/95b4bdb5ae6de8a2. Report an issue: GitHub.