larksuite/cli · error

%s: path %q is not inside any trusted directory

Error message

%s: path %q is not inside any trusted directory

What it means

requireInTrustedDirs enforces the caller-declared TrustedDirs allowlist: the (symlink-resolved) effective path must equal a trusted directory or live under one of them. The library throws this because a path outside the declared trusted roots could be swapped or planted by a lower-privileged user, defeating the security audit. An empty TrustedDirs list disables the check entirely.

Source

Thrown at internal/binding/audit.go:132

	}
	return resolved, nil
}

// requireInTrustedDirs enforces that effectivePath lives under one of the
// caller-declared trusted directories, if any were declared. An empty
// trustedDirs list disables the check.
func requireInTrustedDirs(effectivePath string, trustedDirs []string, label string) error {
	if len(trustedDirs) == 0 {
		return nil
	}
	cleaned := filepath.Clean(effectivePath)
	for _, dir := range trustedDirs {
		cleanDir := filepath.Clean(dir)
		if cleaned == cleanDir || strings.HasPrefix(cleaned, cleanDir+"/") {
			return nil
		}
	}
	return fmt.Errorf("%s: path %q is not inside any trusted directory", label, effectivePath)
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Move the file into one of the declared trusted directories, or configure the exact path of a file already inside them
2. Add the file's real directory to TrustedDirs in the configuration that declares them (only if that directory meets your trust requirements)
3. Run readlink -f on the configured path — if it escapes the trusted dirs, fix the symlink
4. Normalize TrustedDirs entries (absolute, no trailing slash) so prefix matching works as intended

Example fix

// before
TrustedDirs: []string{"/opt/tool/bin"}, TargetPath: "/home/alice/tool.sh"
// after: move the script and point at it
mv /home/alice/tool.sh /opt/tool/bin/tool.sh; TargetPath: "/opt/tool/bin/tool.sh"

func inTrustedDirs(p string, dirs []string) bool {
  c := filepath.Clean(p)
  for _, d := range dirs {
    cd := filepath.Clean(d)
    if c == cd || strings.HasPrefix(c, cd+string(os.PathSeparator)) { return true }
  }
  return false
}
// call before AssertSecurePath: if !inTrustedDirs(target, trustedDirs) { fix path or dirs }

When it happens

Trigger: AssertSecurePath called with non-empty AuditParams.TrustedDirs while filepath.Clean(effectivePath) neither equals any cleaned trusted dir nor has it as a path-segment prefix; commonly after a symlink resolves somewhere outside the trusted roots.

Common situations: Config entry points at ~/scripts/tool.sh but TrustedDirs only contains /usr/local/bin or /opt/tool/bin; symlink in a trusted dir pointing to a user-writable location outside the roots; TrustedDirs entries with trailing slashes or uncleaned forms compared incorrectly against unusual paths; user moved a script to a different directory.

Related errors

• %s: path must be absolute, got %q
• %s: cannot stat %q: %w
• %s: path %q is a directory, not a file
• %s: path %q is a symlink (not allowed)
• %s: cannot resolve symlink %q: %w

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/7de32f6cd5723244. Report an issue: GitHub.