larksuite/cli · error

stat policy yaml %q: %w

Error message

stat policy yaml %q: %w

What it means

LoadYAMLPolicy stats the policy YAML to detect existence; a missing file is silently ignored (nil, nil), but any other stat failure is wrapped as 'stat policy yaml %q: %w'. It means the file's existence/properties could not be determined for reasons other than non-existence.

Source

Thrown at internal/cmdpolicy/resolver.go:106

			seen[pr.PluginName] = true
			owners = append(owners, pr.PluginName)
		}
	}
	return owners
}

// LoadYAMLPolicy returns (nil, nil) when path is empty or file is absent,
// so callers can pass the result straight into Sources.YAMLRules. A
// present file yields one or more rules (see yaml.Parse).
func LoadYAMLPolicy(path string) ([]*platform.Rule, error) {
	if path == "" {
		return nil, nil
	}
	if _, err := vfs.Stat(path); err != nil {
		if errors.Is(err, os.ErrNotExist) {
			return nil, nil
		}
		return nil, fmt.Errorf("stat policy yaml %q: %w", path, err)
	}
	data, err := vfs.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("read policy yaml %q: %w", path, err)
	}
	rules, err := pyaml.Parse(data)
	if err != nil {
		return nil, fmt.Errorf("policy yaml %q: %w", path, err)
	}
	return rules, nil
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Verify each path component of the policy path exists, is a directory, and is traversable
2. Fix permissions on the parent directories (chmod/chown)
3. Check the configured policy path for typos that land on a non-directory
4. If using a sandboxed FileIO, ensure the path is inside the allowed tree

Example fix

// before
LoadYAMLPolicy(fio, "/root/.lark/policy.yaml") // stat: permission denied
// after
LoadYAMLPolicy(fio, filepath.Join(configDir, "policy.yaml"))

dir := filepath.Dir(policyPath)
if st, err := os.Stat(dir); err != nil || !st.IsDir() {
    return fmt.Errorf("policy parent dir %s not accessible", dir)
}

rules, err := cmdpolicy.LoadYAMLPolicy(fio, path)
if err != nil {
    if strings.Contains(err.Error(), "stat policy yaml") {
        // fix path/permissions; a missing file would NOT error here
    }
    return err
}

When it happens

Trigger: vfs.Stat(path) returns an error that is not os.ErrNotExist — e.g. a path component is not a directory, permission denied on a parent directory, or an I/O error on the underlying filesystem.

Common situations: Policy path points inside a directory the process cannot traverse, a symlink loop, a configured policy path whose parent is a regular file, or network/storage backend errors in sandboxed FileIO.

Related errors

• read policy yaml %q: %w
• policy yaml %q: %w
• invalid chart size: {size!r}
• No visible worksheet matched
• +csv-get truncated the scan range at {actual_range}; narrow

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/b1ea6acba2b429da. Report an issue: GitHub.