larksuite/cli · error

failed to read response body in security transport: %w

Error message

failed to read response body in security transport: %w

What it means

The security transport RoundTrip failed to read up to 64KB of the response body while checking for security-policy errors. It closes resp.Body and returns this wrapped error (%w, so the cause is unwrappable). The original response never reaches the caller.

Source

Thrown at internal/auth/transport.go:69

			resp.Body.Close()
		}
		return nil, err
	}
	if resp == nil || resp.Body == nil {
		return resp, nil
	}

	// Only process JSON responses to avoid memory spikes on large files
	contentType := strings.ToLower(resp.Header.Get("Content-Type"))
	if !strings.Contains(contentType, "application/json") {
		return resp, nil
	}

	// Read up to 64KB of the body to check for security policy errors
	bodyBytes, err := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
	if err != nil {
		resp.Body.Close()
		return nil, fmt.Errorf("failed to read response body in security transport: %w", err)
	}

	// Restore the body so it can be read by the caller, preserving streaming capability
	resp.Body = struct {
		io.Reader
		io.Closer
	}{
		io.MultiReader(bytes.NewReader(bodyBytes), resp.Body),
		resp.Body,
	}

	// Try to parse it as JSON
	var result map[string]interface{}
	if err := json.Unmarshal(bodyBytes, &result); err != nil {
		return resp, nil
	}

	// 1. Try to handle as MCP (JSON-RPC) format first

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Retry the request — the wrapped cause (after 'security transport:') tells whether it was a reset, timeout, or EOF.
2. Inspect network path/proxy stability to open.feishu.cn.
3. If reproducible with a specific request, capture the request and test it directly to determine whether the server is aborting it.
4. Since the cause is %w-wrapped, use errors.Is(err, io.ErrUnexpectedEOF) etc. in caller code to branch on the exact transport failure.

Example fix

// caller
if err != nil {
    if errors.Is(err, io.ErrUnexpectedEOF) { retry(); return }
    return err
}

func isSecurityTransportReadErr(err error) bool {
    return err != nil && strings.Contains(err.Error(), "failed to read response body in security transport")
}

resp, err := client.Do(req)
if isSecurityTransportReadErr(err) {
    if errors.Is(err, io.ErrUnexpectedEOF) || errors.Is(err, context.DeadlineExceeded) {
        return retry(req)
    }
    return err
}

When it happens

Trigger: RoundTrip's io.ReadAll(io.LimitReader(resp.Body, 64*1024)) errors — connection reset or timeout while reading the head of the body, chunked-encoding corruption, or the server aborts the response.

Common situations: Unstable network between client and Lark gateway; TLS-terminating proxy killing long-lived connections mid-body; server-side abort on policy-violating requests.

Related errors

• Device authorization failed: read body: %v
• index request failed: %s
• fetch bot info: %w
• annotated_csv did not parse into the rows the server reporte
• app registration failed: HTTP %d – response not JSON

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/2a1aa99695fc392f. Report an issue: GitHub.