What causes "failed to write auth file: %w" in router-for-me/CLIProxyAPI?

Inspect the wrapped *fs.PathError for errno (EACCES, ENOSPC, EROFS)

failed to write auth file: %w

Error message

failed to write auth file: %w

What it means

Wrapped error from os.WriteFile in Host.saveAuthFile with mode 0600 when persisting the auth file fails. The %w preserves the underlying PathError; typical causes are missing directory, permission denied, or disk full.

Source

Thrown at internal/pluginhost/auth_callbacks.go:297

}

func (h *Host) saveAuthFile(ctx context.Context, name string, data []byte) (string, error) {
	authDir := h.resolvedAuthDir()
	if authDir == "" {
		return "", fmt.Errorf("auth directory is unavailable")
	}
	dst := filepath.Join(authDir, filepath.Base(name))
	if !filepath.IsAbs(dst) {
		if abs, errAbs := filepath.Abs(dst); errAbs == nil {
			dst = abs
		}
	}
	auth, errBuild := h.buildAuthFromFileData(dst, data)
	if errBuild != nil {
		return "", errBuild
	}
	if errWrite := os.WriteFile(dst, data, 0o600); errWrite != nil {
		return "", fmt.Errorf("failed to write auth file: %w", errWrite)
	}
	if errUpsert := h.upsertAuthRecord(ctx, auth); errUpsert != nil {
		return "", errUpsert
	}
	return dst, nil
}

func (h *Host) buildAuthFromFileData(path string, data []byte) (*coreauth.Auth, error) {
	if strings.TrimSpace(path) == "" {
		return nil, fmt.Errorf("auth path is empty")
	}
	if data == nil {
		var errRead error
		data, errRead = os.ReadFile(path)
		if errRead != nil {
			return nil, fmt.Errorf("failed to read auth file: %w", errRead)
		}
	}

View on GitHub (pinned to 78f0c4079e)

Solutions

Inspect the wrapped *fs.PathError for errno (EACCES, ENOSPC, EROFS)
Create the auth directory and chown/chmod it for the process user
Mount a writable persistent volume at the auth path in container deployments

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-flight writability check:
probe := filepath.Join(authDir, ".write-probe")
if err := os.WriteFile(probe, nil, 0o600); err != nil {
    // surface permission/disk issue before the real save
} else { os.Remove(probe) }

Try / catch

var pathErr *fs.PathError
if errors.As(err, &pathErr) {
    // EACCES -> fix perms; ENOSPC -> free space; EROFS -> remount/mount volume
}

Prevention

Mount a writable persistent volume at auths/ in containers
Include a startup check that creates and removes a probe file in the auth dir

When it happens

Trigger: The auth directory was deleted between resolution and write; process user lacks write permission on auths/; disk quota exhausted; read-only filesystem (common in mis-mounted containers).

Common situations: Container image with auths/ not writable or not volume-mounted; SELinux/AppArmor denying writes; deploying as non-root for the first time against root-owned directories.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/7f1903a59c760551. Report an issue: GitHub.