What causes "decode codex.live-media-relay.allow-private-remote-ips: %w" in router-for-me/CLIProxyAPI?

Set the key to a plain YAML boolean: allow-private-remote-ips: true (no quotes).

decode codex.live-media-relay.allow-private-remote-ips: %w

Error message

decode codex.live-media-relay.allow-private-remote-ips: %w

What it means

While decoding the codex.live-media-relay YAML node, the key allow-private-remote-ips was found but its value could not be decoded into a bool. This is a config-type error: the user wrote a string, number, or nested structure where a boolean is required.

Source

Thrown at internal/config/codex_live.go:34

// UnmarshalYAML supports the deprecated allow-private-remote-ips setting while
// preserving the default behavior of allowing private downstream candidates.
func (c *CodexLiveMediaRelayConfig) UnmarshalYAML(value *yaml.Node) error {
	type plain CodexLiveMediaRelayConfig
	var decoded plain
	if errDecode := value.Decode(&decoded); errDecode != nil {
		return errDecode
	}
	var allowPrivate *bool
	var disablePrivate *bool
	if value.Kind == yaml.MappingNode {
		for index := 0; index+1 < len(value.Content); index += 2 {
			key := value.Content[index].Value
			switch key {
			case "allow-private-remote-ips":
				var setting bool
				if errDecode := value.Content[index+1].Decode(&setting); errDecode != nil {
					return fmt.Errorf("decode codex.live-media-relay.allow-private-remote-ips: %w", errDecode)
				}
				allowPrivate = &setting
			case "disable-private-remote-ips":
				var setting bool
				if errDecode := value.Content[index+1].Decode(&setting); errDecode != nil {
					return fmt.Errorf("decode codex.live-media-relay.disable-private-remote-ips: %w", errDecode)
				}
				disablePrivate = &setting
			}
		}
	}
	if allowPrivate != nil && disablePrivate != nil {
		return errors.New("codex.live-media-relay cannot set both allow-private-remote-ips and disable-private-remote-ips")
	}
	if allowPrivate != nil {
		decoded.DisablePrivateRemoteIPs = !*allowPrivate
		log.Warn("codex.live-media-relay.allow-private-remote-ips is deprecated; use disable-private-remote-ips with the inverse value")
	}

View on GitHub (pinned to 78f0c4079e)

Solutions

Set the key to a plain YAML boolean: allow-private-remote-ips: true (no quotes).
Prefer migrating to the new key disable-private-remote-ips with the inverse value — the old key only logs a deprecation warning.
Run the config through a YAML linter and this project's config validation before deploy.

Example fix

# before
allow-private-remote-ips: "yes"

# after
disable-private-remote-ips: false

Defensive patterns

Strategy: validation

Validate before calling

# yamllint or a dry load before starting the server
go run ./cmd/server --config config.yaml --help 2>&1 | grep -i 'allow-private-remote-ips' || true

Prevention

Use bare booleans (true/false) in YAML; never quoted strings.
Migrate off the deprecated allow-private-remote-ips key to disable-private-remote-ips.
Lint generated configs in CI.

When it happens

Trigger: UnmarshalYAML walks the mapping node and value.Content[index+1].Decode(&setting) fails for allow-private-remote-ips — e.g. 'allow-private-remote-ips: "yes"', ': 1', or ': [true]'.

Common situations: Copy-pasted config from docs using quoted 'yes'/'on' (valid in some YAML apps, not here); env-var templating inserting a string; typo adding a nested block.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/216814cdc2f387b6. Report an issue: GitHub.