larksuite/cli · error

failed to read proxy plugin config %q: %w

Error message

failed to read proxy plugin config %q: %w

What it means

transport.Load returns this error when the proxy plugin config file passed its stat and security audit, but vfs.ReadFile fails. Unlike the stat error (437), this occurs after the file was confirmed present and safe, so the failure is typically a race (file removed/permissions changed between stat and read), an access-control change, or an underlying filesystem error. It wraps the OS error for diagnosis.

Source

Thrown at internal/transport/config.go:108

			loadErr = fmt.Errorf("failed to stat proxy plugin config %q: %w", p, err)
			return
		}
		// Security hardening: this config dictates where ALL outbound CLI traffic
		// egresses and which extra CA is trusted, so a file another local user or
		// process can tamper with (symlink, foreign owner, group/world-writable)
		// could redirect credential traffic. Audit it the same way the CA file is.
		safePath, err := binding.AssertSecurePath(binding.AuditParams{
			TargetPath:            p,
			Label:                 ConfigFileName,
			AllowReadableByOthers: true, // config is not a secret; only writability/owner/symlink matter
		})
		if err != nil {
			loadErr = fmt.Errorf("unsafe proxy plugin config %q: %w", p, err)
			return
		}
		b, err := vfs.ReadFile(safePath)
		if err != nil {
			loadErr = fmt.Errorf("failed to read proxy plugin config %q: %w", p, err)
			return
		}
		var fileCfg Config
		if err := json.Unmarshal(b, &fileCfg); err != nil {
			loadErr = fmt.Errorf("invalid proxy plugin config %q: %w", p, err)
			return
		}

		// Merge: file base + env overrides.
		if cfg == nil {
			cfg = &fileCfg
		} else {
			*cfg = fileCfg
			applyEnvOverrides(cfg)
		}
		loadCfg = cfg
	})
	return loadCfg, loadErr

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Re-run the command — transient races/NFS errors usually clear
2. Check the wrapped OS error for the specific cause (ENOENT vs EACCES vs I/O error)
3. Verify SELinux/AppArmor isn't blocking reads of the config dir (check audit logs; restorecon ~/.lark-cli if mislabeled)
4. If the file keeps disappearing, identify the cleanup process or recreate the config with correct owner and 644 permissions

Example fix

// before
lark-cli ... -> failed to read proxy plugin config: permission denied

// after
chmod u+r ~/.lark-cli/proxy_config.json  # or restorecon ~/.lark-cli on SELinux systems

// confirm readable immediately before invoking the CLI
p := filepath.Join(core.GetConfigDir(), transport.ConfigFileName)
if f, err := os.Open(p); err != nil {
    return fmt.Errorf("proxy config not readable: %w", err)
} else {
    f.Close()
}

var cfg *transport.Config
var err error
for i := 0; i < 3; i++ {
    cfg, err = transport.Load()
    if err == nil || !strings.Contains(err.Error(), "failed to read proxy plugin config") {
        break
    }
    time.Sleep(200 * time.Millisecond) // transient race / NFS hiccup
}

When it happens

Trigger: vfs.ReadFile(safePath) on the audited ~/.lark-cli/proxy_config.json returns an error: the file was deleted between Stat and Read, permissions were tightened in between, an ACL/SELinux/AppArmor policy denies the read, or a network home directory hit an I/O error.

Common situations: Concurrent cleanup scripts or another session removing ~/.lark-cli files while the CLI starts; SELinux/AppArmor denials in hardened containers despite POSIX permissions looking fine; EFS/NFS home mounts with transient I/O failures; backup agents locking files on Windows-style mounts.

Related errors

• %s: cannot stat resolved path %q: %w
• failed to stat proxy plugin config %q: %w
• file changed between validation and open
• file changed between validation and open
• invalid chart size: {size!r}

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/8156fe27a4925046. Report an issue: GitHub.