larksuite/cli · error

read content-safety config: %w

Error message

read content-safety config: %w

What it means

LoadConfig reads the content-safety config file from the given configDir and wraps any read failure from vfs.ReadFile. It means the config file could not be read — usually because it does not exist yet, or permissions/path issues prevent reading it.

Source

Thrown at internal/security/contentsafety/config.go:39

	Allowlist []string
	Rules     []rule
}

type rawConfig struct {
	Allowlist []string  `json:"allowlist"`
	Rules     []rawRule `json:"rules"`
}

type rawRule struct {
	ID      string `json:"id"`
	Pattern string `json:"pattern"`
}

func LoadConfig(configDir string) (*Config, error) {
	path := filepath.Join(configDir, configFileName)
	data, err := vfs.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("read content-safety config: %w", err)
	}
	var raw rawConfig
	if err := json.Unmarshal(data, &raw); err != nil {
		return nil, fmt.Errorf("parse content-safety config: %w", err)
	}
	rules := make([]rule, 0, len(raw.Rules))
	for _, r := range raw.Rules {
		compiled, err := regexp.Compile(r.Pattern)
		if err != nil {
			return nil, fmt.Errorf("compile rule %q pattern: %w", r.ID, err)
		}
		rules = append(rules, rule{ID: r.ID, Pattern: compiled})
	}
	return &Config{Allowlist: raw.Allowlist, Rules: rules}, nil
}

func EnsureDefaultConfig(configDir string, errOut io.Writer) error {
	path := filepath.Join(configDir, configFileName)

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Call EnsureDefaultConfig(configDir, errOut) first to create the default file, or use loadOrCreate which does this
2. Verify configDir points to the directory containing the config file (check LARKSUITE_CLI_CONFIG_DIR)
3. Check file permissions on the config file (expected 0600) and directory (0700)

Example fix

// before
config, err := contentsafety.LoadConfig(dir) // fails: file missing
// after
if err := contentsafety.EnsureDefaultConfig(dir, os.Stderr); err != nil { return err }
config, err := contentsafety.LoadConfig(dir)

path := filepath.Join(configDir, "content-safety-config.json") // see configFileName
if _, err := os.Stat(path); errors.Is(err, os.ErrNotExist) {
	// file missing — create defaults first
}

config, err := contentsafety.LoadConfig(dir)
if err != nil {
	if strings.Contains(err.Error(), "read content-safety config") && errors.Is(err, os.ErrNotExist) {
		if e := contentsafety.EnsureDefaultConfig(dir, os.Stderr); e != nil { return e }
		config, err = contentsafety.LoadConfig(dir)
	}
	if err != nil { return err }
}

When it happens

Trigger: Calling LoadConfig(configDir) when <configDir>/content-safety config file is missing, unreadable (permissions), or configDir is wrong. Also called indirectly through loadOrCreate on CLI startup.

Common situations: Fresh checkout or new machine where EnsureDefaultConfig was never run; LARKSUITE_CLI_CONFIG_DIR pointing at a nonexistent directory; restrictive file permissions on the config file.

Understand the failure class

Background: "Config file not found": what it means and how to fix it in docker-sync, Maven, Vagrant, Turborepo and other tools — this error's family across 60 libraries.

Related errors

• create config dir: %w
• failed to read secret file %s: %w
• create lock dir: %w
• parse content-safety config: %w
• compile rule %q pattern: %w

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/4d940faa7bf62260. Report an issue: GitHub.