What causes "cannot inspect path: %w" in larksuite/cli?

Read the wrapped errno and fix it: for EACCES, chmod/chown the parent directories to allow traversal.

cannot inspect path: %w

Error message

cannot inspect path: %w

What it means

This error is the default branch of `resolveReal`: when Lstat fails with an error other than success, not-exist, or ENOTDIR, the filesystem state of the path cannot be inspected, so the policy rejects the path instead of guessing. The wrapped errno (e.g. EACCES, EIO) is the real cause; the flag name is prefixed upstream in safePath.

Source

Thrown at internal/vfs/localfileio/path.go:305

// file, so the target cannot exist and the write layer will surface the real
// error with proper typing.
func resolveReal(abs string) (string, error) {
	_, lerr := vfs.Lstat(abs)
	switch {
	case lerr == nil:
		resolved, err := filepath.EvalSymlinks(abs)
		if err != nil {
			return "", fmt.Errorf("cannot resolve symlinks: %w", err)
		}
		return resolved, nil
	case os.IsNotExist(lerr) || errors.Is(lerr, syscall.ENOTDIR):
		resolved, err := resolveNearestAncestor(abs)
		if err != nil {
			return "", fmt.Errorf("cannot resolve symlinks: %w", err)
		}
		return resolved, nil
	default:
		return "", fmt.Errorf("cannot inspect path: %w", lerr)
	}
}

func resolveNearestAncestor(path string) (string, error) {
	var tail []string
	cur := path
	for {
		if _, err := vfs.Lstat(cur); err == nil {
			real, err := filepath.EvalSymlinks(cur)
			if err != nil {
				return "", err
			}
			parts := append([]string{real}, tail...)
			return filepath.Join(parts...), nil
		}
		parent := filepath.Dir(cur)
		if parent == cur {
			parts := append([]string{cur}, tail...)

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Read the wrapped errno and fix it: for EACCES, chmod/chown the parent directories to allow traversal.
Check mount health (`dmesg`, remount) if the cause is an I/O error.
Verify no LSM (SELinux/AppArmor) policy is denying stat on the path; adjust or run outside the confined context.
Choose a different target path inside an allowed, accessible root.

Example fix

// before (parent not traversable)
lark-cli drive upload --file /root/secret/data.json
// after
chmod o+x /root   # or use a path your user can traverse
cp /root/secret/data.json ~/files/ && lark-cli drive upload --file ~/files/data.json

Defensive patterns

Strategy: validation

Validate before calling

// Go: pre-flight Lstat to surface the real errno early
if _, err := os.Lstat(p); err != nil && !os.IsNotExist(err) {
    return fmt.Errorf("path %q not inspectable: %w", p, err)
}

Try / catch

// Match the typed cause and branch on the errno
if _, err := localfileio.SafeInputPath(p); err != nil {
    if cause := errors.Unwrap(errors.Unwrap(err)); cause != nil && errors.Is(cause, fs.ErrPermission) {
        return fmt.Errorf("fix traversal permissions on parent directories: %w", cause)
    }
    return err
}

Prevention

Ensure the running user has execute permission on every directory component.
Check SELinux/AppArmor audit logs when EACCES appears without a chmod explanation.
Avoid placing command I/O on flaky network mounts; stage files locally first.

When it happens

Trigger: Calling SafeInputPath/SafeOutputPath with a path where a component returns EACCES (no search permission), EIO (disk/mount error), ELOOP beyond EvalSymlinks handling, or errors on a failing network filesystem.

Common situations: Running in a sandbox/container where the user lacks execute permission on a parent directory; corrupted or half-mounted NFS/FUSE volumes; SELinux/AppArmor denials surfacing as EACCES.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/622baafcb408403c. Report an issue: GitHub.