What causes "invalid deny glob %q: %w" in larksuite/cli?

Repair the pattern: close all character classes and fix escape sequences.

invalid deny glob %q: %w

Error message

invalid deny glob %q: %w

What it means

Same check as the allow globs but applied to Rule.Deny: each deny pattern is parsed via doublestar.Match in validateGlob, and an unparseable pattern produces 'invalid deny glob %q: %w'. This matters even more for deny lists because a malformed deny pattern silently denies nothing, weakening the safety contract.

Source

Thrown at internal/cmdpolicy/validate.go:55

		if !r.MaxRisk.IsValid() {
			return fmt.Errorf("invalid max_risk %q: must be one of read|write|high-risk-write", r.MaxRisk)
		}
	}

	for _, id := range r.Identities {
		if !id.IsValid() {
			return fmt.Errorf("invalid identities entry %q: must be 'user' or 'bot'", id)
		}
	}

	for _, g := range r.Allow {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid allow glob %q: %w", g, err)
		}
	}
	for _, g := range r.Deny {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid deny glob %q: %w", g, err)
		}
	}
	return nil
}

// validateGlob rejects malformed doublestar patterns. doublestar.Match
// returns an error for unbalanced brackets / bad escape sequences; that
// error path is the canonical signal for "this pattern is not valid".
//
// We probe with an empty string -- the goal is to exercise the parser,
// not to compute a match.
func validateGlob(g string) error {
	if g == "" {
		return fmt.Errorf("empty pattern")
	}
	if _, err := doublestar.Match(g, ""); err != nil {
		return err
	}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Repair the pattern: close all character classes and fix escape sequences.
Use forward slashes in globs; doublestar uses '/' as separator.
Validate the deny list with the policy validate subcommand before deploying.

Example fix

// before
deny: ["secret/[a-"]
// after
deny: ["secret/*"]

Defensive patterns

Strategy: validation

Validate before calling

for _, g := range rule.Deny {
	if g == "" {
		return fmt.Errorf("empty deny pattern")
	}
	if _, err := doublestar.Match(g, ""); err != nil {
		return fmt.Errorf("bad deny glob %q: %w", g, err)
	}
}

Try / catch

if err := cmdpolicy.ValidateRule(rule); err != nil {
	// fail closed: refuse to start with an invalid deny glob
	log.Fatalf("refusing to load policy: %v", err)
}

Prevention

Treat deny-list errors as fatal — never fall back to a degraded rule.
Use forward slashes in glob patterns even on Windows.
Unit-test every deny pattern against the paths it must match.
Run the policy validate subcommand before deploying deny changes.

When it happens

Trigger: Calling ValidateRule with a Rule whose Deny slice contains a malformed doublestar pattern such as "secret/[a-" or a pattern with a bad escape sequence.

Common situations: Windows-style backslash paths pasted into deny globs; incomplete edits leaving an unclosed character class; generated configs emitting empty or truncated deny patterns.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/da182325e2be5160. Report an issue: GitHub.