pattern %#q contains invalid character %#q at position %d

Error message

pattern %#q contains invalid character %#q at position %d

What it means

validatePattern checks that environment-variable glob patterns in block/allow lists contain only [a-zA-Z0-9_*]; any other character makes the whole pattern invalid. It returns the offending character and its 1-based-index offset (position of first match) so the user can fix their LIMA_BLOCK/ALLOW list entries.

Source

Thrown at pkg/envutil/envutil.go:52

	"SSH_*",
	"TERM",
	"TERMINFO",
	"TMPDIR",
	"UID",
	"USER",
	"XAUTHORITY",
	"XDG_*",
	"ZDOTDIR",
	"ZSH*",
	"_*", // Variables starting with underscore are typically internal
}

func validatePattern(pattern string) error {
	invalidChar := regexp.MustCompile(`([^a-zA-Z0-9_*])`)
	if matches := invalidChar.FindStringSubmatch(pattern); matches != nil {
		invalidCharacter := matches[1]
		pos := strings.Index(pattern, invalidCharacter)
		return fmt.Errorf("pattern %#q contains invalid character %#q at position %d",
			pattern, invalidCharacter, pos)
	}
	return nil
}

// getBlockList returns the list of environment variable patterns to be blocked.
func getBlockList() []string {
	blockEnv := os.Getenv("LIMA_SHELLENV_BLOCK")
	if blockEnv == "" {
		return defaultBlockList
	}

	shouldAppend := strings.HasPrefix(blockEnv, "+")
	patterns := parseEnvList(strings.TrimPrefix(blockEnv, "+"))

	for _, pattern := range patterns {
		if err := validatePattern(pattern); err != nil {
			logrus.Fatalf("Invalid LIMA_SHELLENV_BLOCK pattern: %v", err)

View on GitHub (pinned to dd909d0973)

Solutions

Replace invalid characters with `*` wildcards or remove them, e.g. `FO?BAR` → `FO*BAR`
Use only allowed chars: letters, digits, `_`, and `*`
Check the reported position number in the error to locate the bad character in the pattern
Re-check list separators — entries must be split correctly, not contain embedded delimiters

Example fix

// before
pattern: "FOO?BAR"  // invalid character '?' at position 3
// after
pattern: "FOO*BAR"

Defensive patterns

Strategy: validation

Validate before calling

var validPattern = regexp.MustCompile(`^[a-zA-Z0-9_*]+$`)
func validEnvPattern(p string) bool { return validPattern.MatchString(p) }
// check each entry before use
for _, p := range patterns {
    if !validEnvPattern(p) { return fmt.Errorf("invalid pattern %q", p) }
}

Try / catch

if err := envutil.ValidatePattern(p); err != nil {
    // parse position from error and fix the pattern before retry
    return fmt.Errorf("fix block/allow list entry: %w", err)
}

Prevention

Use only letters, digits, `_` and `*` in env patterns
Never use shell glob syntax like ? or [ ] in lima env patterns
Validate config lists after edits before applying them
Split list entries correctly to avoid embedded separators

When it happens

Trigger: Calling getBlockList / getAllowList (i.e. lima env-variable filtering) when an entry in the block or allow list contains characters outside letters, digits, underscore, and `*` — e.g. `FOO?BAR`, `FO[O]`, or a stray comma/space.

Common situations: Typos in wildcard patterns in _LIMA_BLOCK_ENV / allow config; copying shell glob syntax like `?` or character classes; accidental whitespace or separators inside a list entry.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of lima-vm/lima@dd909d0973 (2026-09-01). Data as JSON: /api/errors/3229be5951577a73. Report an issue: GitHub.