What causes "create config dir: %w" in larksuite/cli?

Check whether configDir exists as a file and remove/rename it

create config dir: %w

Error message

create config dir: %w

What it means

EnsureDefaultConfig creates the config directory (via vfs.MkdirAll, mode 0700) before writing the default content-safety config file. This error wraps a failure to create that directory — e.g. a file exists at that path, or permission is denied on the parent.

Source

Thrown at internal/security/contentsafety/config.go:62

	}
	rules := make([]rule, 0, len(raw.Rules))
	for _, r := range raw.Rules {
		compiled, err := regexp.Compile(r.Pattern)
		if err != nil {
			return nil, fmt.Errorf("compile rule %q pattern: %w", r.ID, err)
		}
		rules = append(rules, rule{ID: r.ID, Pattern: compiled})
	}
	return &Config{Allowlist: raw.Allowlist, Rules: rules}, nil
}

func EnsureDefaultConfig(configDir string, errOut io.Writer) error {
	path := filepath.Join(configDir, configFileName)
	if _, err := vfs.Stat(path); err == nil {
		return nil
	}
	if err := vfs.MkdirAll(configDir, 0700); err != nil {
		return fmt.Errorf("create config dir: %w", err)
	}
	data, err := json.MarshalIndent(defaultRawConfig(), "", "  ")
	if err != nil {
		return fmt.Errorf("marshal default config: %w", err)
	}
	if err := vfs.WriteFile(path, append(data, '\n'), fs.FileMode(0600)); err != nil {
		return err
	}
	fmt.Fprintf(errOut, "notice: created default content-safety config at %s\n", path)
	return nil
}

func defaultRawConfig() rawConfig {
	return rawConfig{
		Allowlist: []string{"all"},
		Rules: []rawRule{
			{
				ID:      "instruction_override",

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Check whether configDir exists as a file and remove/rename it
Fix permissions on the parent directory so the process can create the directory
Point LARKSUITE_CLI_CONFIG_DIR at a writable directory
Inspect the wrapped %w cause (syscall) for the exact OS-level reason

Example fix

// before
export LARKSUITE_CLI_CONFIG_DIR=/home/me/config-file.txt  // it's a file
// after
rm /home/me/config-file.txt
export LARKSUITE_CLI_CONFIG_DIR=/home/me/.config/lark-cli

Defensive patterns

Strategy: validation

Validate before calling

if info, err := os.Stat(configDir); err == nil && !info.IsDir() {
	return fmt.Errorf("%s exists and is not a directory", configDir)
}
if err := os.MkdirAll(configDir, 0o700); err != nil {
	return fmt.Errorf("cannot create config dir: %w", err)
}

Try / catch

if err := contentsafety.EnsureDefaultConfig(dir, os.Stderr); err != nil {
	if strings.Contains(err.Error(), "create config dir") && errors.Is(err, os.ErrPermission) {
		// pick a writable dir or fix parent permissions
	}
	return err
}

Prevention

Ensure LARKSUITE_CLI_CONFIG_DIR points to a directory, never a file
Provision config dirs with mode 0700 in setup scripts
Avoid read-only filesystems for config storage
Check disk space and parent-directory write access

When it happens

Trigger: Calling EnsureDefaultConfig(configDir, errOut) (directly or via loadOrCreate) when configDir exists as a regular file, or a parent directory blocks creation with EACCES/EPERM.

Common situations: LARKSUITE_CLI_CONFIG_DIR accidentally set to a file path; read-only home or container filesystem; a stale file where the config directory should be.

Understand the failure class

Background: mkdir permission denied (EACCES): failed to create directory errors explained — this error's family across 32 libraries.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/34498047492464aa. Report an issue: GitHub.