What causes "read policy yaml %q: %w" in larksuite/cli?

Fix read permissions on the policy file (chmod u+r / correct owner)

read policy yaml %q: %w

Error message

read policy yaml %q: %w

What it means

After confirming the policy YAML exists via Stat, LoadYAMLPolicy reads it with vfs.ReadFile; any read failure is wrapped as 'read policy yaml %q: %w'. This is distinct from stat errors and parse errors — the file exists but its content could not be read.

Source

Thrown at internal/cmdpolicy/resolver.go:110

	return owners
}

// LoadYAMLPolicy returns (nil, nil) when path is empty or file is absent,
// so callers can pass the result straight into Sources.YAMLRules. A
// present file yields one or more rules (see yaml.Parse).
func LoadYAMLPolicy(path string) ([]*platform.Rule, error) {
	if path == "" {
		return nil, nil
	}
	if _, err := vfs.Stat(path); err != nil {
		if errors.Is(err, os.ErrNotExist) {
			return nil, nil
		}
		return nil, fmt.Errorf("stat policy yaml %q: %w", path, err)
	}
	data, err := vfs.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("read policy yaml %q: %w", path, err)
	}
	rules, err := pyaml.Parse(data)
	if err != nil {
		return nil, fmt.Errorf("policy yaml %q: %w", path, err)
	}
	return rules, nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Fix read permissions on the policy file (chmod u+r / correct owner)
Verify the path is a regular file, not a directory or broken special file
Re-run the command if the failure was transient (file being rewritten concurrently)
Recreate the policy YAML if it was deleted or corrupted

Example fix

// before
-rw------- 1 root root policy.yaml  # read as non-root fails
// after
chmod 644 policy.yaml

Defensive patterns

Strategy: try-catch

Validate before calling

if st, err := os.Stat(policyPath); err != nil || st.IsDir() {
    return fmt.Errorf("policy path must be a readable regular file")
}
if f, err := os.Open(policyPath); err != nil { return err } else { f.Close() }

Try / catch

rules, err := cmdpolicy.LoadYAMLPolicy(fio, path)
if err != nil {
    if strings.Contains(err.Error(), "read policy yaml") {
        // fix file permissions or recreate the file
    }
    return err
}

Prevention

Set readable permissions (e.g. 0644) on the policy file
Ensure the path is a regular file, not a directory
Avoid concurrent rewrites; use atomic rename when updating the policy
Recreate the file if storage reported transient read errors

When it happens

Trigger: vfs.ReadFile fails on an existing policy file: permission denied on the file itself, it is a directory named policy.yaml, an I/O error, or the file was deleted between Stat and Read (TOCTOU).

Common situations: Policy file with restrictive permissions (e.g. owned by another user), file replaced by a directory, encrypted/synced storage returning transient read errors, or race with an external process removing the file.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/88b96da5e02fe028. Report an issue: GitHub.