plandex-ai/plandex · error

failed to load file for %s: %v

Error message

failed to load file for %s: %v

What it means

ResolveProviderAuthVars treats certain ExtraAuthVars (MaybeJSONFilePath) as either inline JSON, base64-encoded JSON, or a path to a JSON file. When the value is not JSON and os.ReadFile fails, the library wraps the read error as 'failed to load file for <VAR>'. The credential var could not be populated.

Source

Thrown at app/cli/lib/model_credentials.go:290

		val := os.Getenv(cfg.ApiKeyEnvVar)
		if val != "" {
			authVars[cfg.ApiKeyEnvVar] = val
		}
	}

	for _, extra := range cfg.ExtraAuthVars {
		val := os.Getenv(extra.Var)
		if val == "" && extra.Default != "" {
			val = extra.Default
		}

		if extra.MaybeJSONFilePath {
			if val == "" {
				continue
			}
			content, err := maybeLoadFile(val)
			if err != nil {
				return nil, fmt.Errorf("failed to load file for %s: %v", extra.Var, err)
			}
			authVars[extra.Var] = content
		} else if val != "" {
			authVars[extra.Var] = val
		}
	}

	return authVars, nil
}

func maybeLoadFile(pathOrJson string) (string, error) {
	if strings.HasPrefix(strings.TrimSpace(pathOrJson), "{") {
		// var contains json directly, so we can return it as is
		return pathOrJson, nil
	}

	// see if it's base64 encoded json
	decoded, err := base64.StdEncoding.DecodeString(pathOrJson)

View on GitHub (pinned to e2d772072e)

Solutions

1. Verify the file at the env-var path exists and is readable (ls / cat it as the running user).
2. Use an absolute path; relative paths resolve against the process working directory.
3. If embedding credentials, ensure the value is raw JSON starting with '{' or valid base64 whose decoded content starts with '{'.
4. Re-download/regenerate the credential file (e.g. a new service-account key) if it was deleted or rotated.

Example fix

// before
export GOOGLE_APPLICATION_CREDENTIALS="./key.json"
// after
export GOOGLE_APPLICATION_CREDENTIALS="/etc/secrets/service-account-key.json" # absolute, existing file

test -r "$GOOGLE_APPLICATION_CREDENTIALS" || echo "credential file missing"

func validateCredentialFilePath(envVar string) error {
    v := os.Getenv(envVar)
    if v == "" || strings.HasPrefix(strings.TrimSpace(v), "{") { return nil }
    if _, err := base64.StdEncoding.DecodeString(v); err == nil { return nil }
    if _, err := os.Stat(v); err != nil { return fmt.Errorf("%s points to unreadable file: %w", envVar, err) }
    return nil
}

content, err := maybeLoadFile(val)
if err != nil {
    return nil, fmt.Errorf("check %s: must be JSON, base64 JSON, or a readable file path: %w", envVarName, err)
}

When it happens

Trigger: Setting an ExtraAuthVar (e.g. a service-account key var) to a path that does not exist, is unreadable, or contains neither JSON nor base64-encoded JSON nor a valid file path.

Common situations: GOOGLE_APPLICATION_CREDENTIALS-style var pointing at a deleted key file after cleanup, base64 value that decodes but is not JSON, mounting the secret at a different path in CI than locally, or relative paths resolved against an unexpected working directory.

Related errors

• error loading accounts: %v
• refresh failed - save: %w
• error checking API keys/credentials: %v
• failed to load AWS config: %v
• error setting auth: %v

AI-assisted analysis of plandex-ai/plandex@e2d772072e (2026-09-05). Data as JSON: /api/errors/24ced20ebd2d63d1. Report an issue: GitHub.