What causes "invalid allow glob %q: %w" in larksuite/cli?

Fix the pattern syntax: balance all [ ] brackets and remove dangling escape backslashes.

invalid allow glob %q: %w

Error message

invalid allow glob %q: %w

What it means

ValidateRule passes each Rule.Allow pattern through validateGlob, which probes the pattern with doublestar.Match to exercise the parser. A pattern doublestar cannot parse (unbalanced brackets, bad escape sequences) is wrapped as 'invalid allow glob %q: %w'. This exists because a malformed glob never matches anything, so a typo'd allow list would silently allow nothing.

Source

Thrown at internal/cmdpolicy/validate.go:50

	if r == nil {
		return nil
	}

	if r.MaxRisk != "" {
		if !r.MaxRisk.IsValid() {
			return fmt.Errorf("invalid max_risk %q: must be one of read|write|high-risk-write", r.MaxRisk)
		}
	}

	for _, id := range r.Identities {
		if !id.IsValid() {
			return fmt.Errorf("invalid identities entry %q: must be 'user' or 'bot'", id)
		}
	}

	for _, g := range r.Allow {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid allow glob %q: %w", g, err)
		}
	}
	for _, g := range r.Deny {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid deny glob %q: %w", g, err)
		}
	}
	return nil
}

// validateGlob rejects malformed doublestar patterns. doublestar.Match
// returns an error for unbalanced brackets / bad escape sequences; that
// error path is the canonical signal for "this pattern is not valid".
//
// We probe with an empty string -- the goal is to exercise the parser,
// not to compute a match.
func validateGlob(g string) error {
	if g == "" {

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Fix the pattern syntax: balance all [ ] brackets and remove dangling escape backslashes.
Test the pattern with doublestar.Match locally against a sample path.
Escape special characters like [ and ? if the value is meant to match literally.

Example fix

// before
allow: ["docs/[abc"]
// after
allow: ["docs/*"]

Defensive patterns

Strategy: validation

Validate before calling

for _, g := range rule.Allow {
	if _, err := doublestar.Match(g, ""); err != nil {
		return fmt.Errorf("bad allow glob %q: %w", g, err)
	}
}

Try / catch

if err := cmdpolicy.ValidateRule(rule); err != nil {
	return fmt.Errorf("policy load rejected: %w", err)
}

Prevention

Test every glob against a sample positive and negative path before committing the policy.
Escape literal [ ? * characters when the pattern is meant to match literally.
Prefer simple wildcards (docs/*) over complex character classes.
Lint policy files in CI with the validate subcommand.

When it happens

Trigger: Calling ValidateRule with a Rule whose Allow slice contains a malformed doublestar pattern, e.g. "docs/[abc" (unclosed character class) or "a\\" (trailing escape).

Common situations: Hand-writing globs in policy YAML and leaving a bracket unclosed; incorrect backslash escaping on Windows paths; pasting a regex into a glob field; whitespace-only patterns.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/b48558a2334f42f9. Report an issue: GitHub.