larksuite/cli · error

registry create/open failed: %w

Error message

registry create/open failed: %w

What it means

This error wraps a failure to create or open the registry key (HKCU path derived from the service) where the keychain stores an encrypted credential. registry.CreateKey with SET_VALUE access failed, so the credential was never written. The %w preserves the underlying Windows registry error (e.g. access denied, invalid key path).

Source

Thrown at internal/keychain/keychain_windows.go:164

	}
	blob, err := base64.StdEncoding.DecodeString(b64)
	if err != nil {
		return "", false
	}
	entropy := dpapiEntropy(service, account)
	plain, err := dpapiUnprotect(blob, entropy)
	if err != nil {
		return "", false
	}
	return string(plain), true
}

// registrySet stores a string value in the registry under the given service and account.
func registrySet(service, account string, protected []byte) error {
	keyPath := registryPathForService(service)
	k, _, err := registry.CreateKey(registry.CURRENT_USER, keyPath, registry.SET_VALUE)
	if err != nil {
		return fmt.Errorf("registry create/open failed: %w", err)
	}
	defer k.Close()

	b64 := base64.StdEncoding.EncodeToString(protected)
	if err := k.SetStringValue(valueNameForAccount(account), b64); err != nil {
		return fmt.Errorf("registry set failed: %w", err)
	}
	return nil
}

// registryRemove deletes a value from the registry under the given service and account.
func registryRemove(service, account string) error {
	keyPath := registryPathForService(service)
	k, err := registry.OpenKey(registry.CURRENT_USER, keyPath, registry.SET_VALUE)
	if err != nil {
		return nil
	}
	defer k.Close()

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Read the wrapped cause (e.g. 'Access is denied') to determine whether it is permissions or path-related.
2. Run the command in a normal user session so HKCU is loaded and writable.
3. Check group policy / antivirus 'registry protection' rules blocking writes under HKCU\Software.
4. Sanitize the service/account strings used to build the key path if they may contain illegal characters.

Example fix

// before: run-as-service context without HKCU
schtasks /run /tn backup-task  // CreateKey fails: access denied

// after: run interactively as the user
C:\Users\dev> lark-cli auth login

// Pre-check: ensure HKCU is writable and the target key path has no illegal chars
if service != filepath.Base(service) || strings.ContainsAny(service, `\/:*?"<>|`) {
    return fmt.Errorf("service name contains characters invalid for a registry path: %q", service)
}
k, err := registry.OpenKey(registry.CURRENT_USER, `Software`, registry.SET_VALUE)
if err != nil {
    return fmt.Errorf("HKCU not writable in this session: %w", err)
}
k.Close()

if err := keychain.Set(service, account, secret); err != nil {
    if strings.Contains(err.Error(), "registry create/open failed") {
        return fmt.Errorf("cannot open registry key (run interactively, check policy): %w", err)
    }
    return err
}

When it happens

Trigger: platformSet -> registrySet: registry.CreateKey(registry.CURRENT_USER, keyPath, registry.SET_VALUE) returns an error for the service's key path.

Common situations: Registry virtualization/redirection issues when a 32-bit process writes under Wow6432Node-restricted paths; group policy or endpoint security software blocking HKCU writes; HKEY_CURRENT_USER not loaded (run-as service, scheduled task without profile); key path containing characters derived from a malformed service name.

Related errors

• registry set failed: %w
• keychain access blocked
• dpapi protect failed: %w
• keychain: item not found
• keychain not initialized

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/de18af18134f9699. Report an issue: GitHub.