What causes "local input path must not be empty" in larksuite/cli?

Populate the path argument before calling the API or command

local input path must not be empty

Error message

local input path must not be empty

What it means

LocalInputPath validates a user-supplied input path in the relaxed local tier and rejects a value that is empty or only whitespace before any other check. The tier returns the path verbatim, so an empty string could never name a real file and would only produce confusing downstream OS errors.

Source

Thrown at internal/vfs/localfileio/path.go:62

// The baseline invariant asserted by drive sync, upload flags, and the CI
// quality gates is "reject everything outside the built-in allowlist"
// (cwd, /tmp, ~/files) — see safePath. Out-of-tree content still reaches
// flags via stdin ("-").
func SafeInputPath(path string) (string, error) {
	return safePath(path, "--file")
}

// LocalInputPath validates an input path in the process local filesystem
// namespace. It intentionally does not impose allowlist containment or
// canonicalize the returned path: absolute paths, parent-relative paths, and
// symlink traversal retain their normal OS semantics (the grandfathered
// apps-upload exception, see #2005). The built-in denylist still applies:
// even the relaxed tier may not reach protected directories. Character
// validation remains mandatory because paths are user-controlled and may
// appear in errors or progress output.
func LocalInputPath(path string) (string, error) {
	if strings.TrimSpace(path) == "" {
		return "", fmt.Errorf("local input path must not be empty")
	}
	if strings.IndexFunc(path, unicode.IsControl) >= 0 {
		return "", fmt.Errorf("local input path must not contain control characters")
	}
	if err := charcheck.RejectControlChars(path, "local input path"); err != nil {
		return "", err
	}
	if err := validateLocalInputPlatform(path); err != nil {
		return "", err
	}
	if err := denyCheckLocalInput(path); err != nil {
		return "", err
	}
	return path, nil
}

// denyCheckLocalInput applies the built-in denylist to the relaxed local
// input tier. Resolution is fail-closed like safePath, but the allowlist is

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Populate the path argument before calling the API or command
Check that the producing variable/config key is actually set: `${FILE:?FILE not set}` in shell
Fail fast in your script if the value is empty before invoking the CLI

Example fix

// before
p, err := localfileio.LocalInputPath(cfg.FilePath)
// after
if strings.TrimSpace(cfg.FilePath) == "" {
    return fmt.Errorf("--file is required")
}
p, err := localfileio.LocalInputPath(cfg.FilePath)

Defensive patterns

Strategy: validation

Validate before calling

if strings.TrimSpace(p) == "" {
    return errors.New("input file path is required")
}

Type guard

func nonEmptyPath(p string) (string, bool) {
    p = strings.TrimSpace(p)
    return p, p != ""
}

Try / catch

p, err := localfileio.LocalInputPath(flagValue)
if err != nil {
    return fmt.Errorf("--file: %w", err)
}

Prevention

Use ${VAR:?msg} guards for path variables in shell
Fail fast on empty flag values at argument parsing time
Check upstream command exit codes before reusing their output as a path

When it happens

Trigger: Calling localfileio.LocalInputPath("") or LocalInputPath(" ") — e.g. a --file flag value that was never populated, an unset config value, or a shell variable expanding to nothing.

Common situations: A shell variable like $FILE is empty because the producing command failed; a CI secret/variable not set; a script passing ${1:-} through; config file with an empty key.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/8556fc6f8832b4a3. Report an issue: GitHub.