larksuite/cli · error

registry set failed: %w

Error message

registry set failed: %w

What it means

This error wraps a failure to write the (already DPAPI-protected, base64-encoded) credential string into the opened registry value. The key was created/opened successfully but k.SetStringValue failed, so the credential store write did not complete. The %w preserves the underlying Windows error for diagnosis.

Source

Thrown at internal/keychain/keychain_windows.go:170

	plain, err := dpapiUnprotect(blob, entropy)
	if err != nil {
		return "", false
	}
	return string(plain), true
}

// registrySet stores a string value in the registry under the given service and account.
func registrySet(service, account string, protected []byte) error {
	keyPath := registryPathForService(service)
	k, _, err := registry.CreateKey(registry.CURRENT_USER, keyPath, registry.SET_VALUE)
	if err != nil {
		return fmt.Errorf("registry create/open failed: %w", err)
	}
	defer k.Close()

	b64 := base64.StdEncoding.EncodeToString(protected)
	if err := k.SetStringValue(valueNameForAccount(account), b64); err != nil {
		return fmt.Errorf("registry set failed: %w", err)
	}
	return nil
}

// registryRemove deletes a value from the registry under the given service and account.
func registryRemove(service, account string) error {
	keyPath := registryPathForService(service)
	k, err := registry.OpenKey(registry.CURRENT_USER, keyPath, registry.SET_VALUE)
	if err != nil {
		return nil
	}
	defer k.Close()
	_ = k.DeleteValue(valueNameForAccount(account))
	return nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Read the wrapped cause for the specific Win32 error and map it (access denied vs. invalid handle).
2. Check ACLs on the HKCU\Software key path and ensure the current user has Set Value permission.
3. Exclude the CLI's registry path from security software that blocks credential-storage writes.
4. Retry the auth/store operation; if it persists, delete the stale key and let the CLI recreate it.

if err := keychain.Set(service, account, secret); err != nil {
    if strings.Contains(err.Error(), "registry set failed") {
        // key opened but write rejected: ACL/security software; advise cleanup + retry
        return fmt.Errorf("registry write rejected, check ACLs/AV on HKCU key: %w", err)
    }
    return err
}

When it happens

Trigger: platformSet -> registrySet: after a successful CreateKey, k.SetStringValue(valueNameForAccount(account), b64) returns an error.

Common situations: Key handle opened read-only due to weird ACL inheritance despite SET_VALUE request; quota or policy limits on registry value size; endpoint security intercepting writes to credential-like values; key deleted between open and set by another process/cleanup tool.

Related errors

• registry create/open failed: %w
• keychain access blocked
• dpapi protect failed: %w
• keychain: item not found
• keychain not initialized

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/064090a552f62973. Report an issue: GitHub.