What causes "invalid auth file: %w" in router-for-me/CLIProxyAPI?

Route writes through the validated save request path so JSON is checked first

invalid auth file: %w

Error message

invalid auth file: %w

What it means

Wrapped error from Host.buildAuthFromFileData when json.Unmarshal of the (read or provided) bytes into map[string]any fails. The builder requires a JSON object as the auth metadata source; malformed input aborts record construction before the auth is created or upserted.

Source

Thrown at internal/pluginhost/auth_callbacks.go:318

		return "", errUpsert
	}
	return dst, nil
}

func (h *Host) buildAuthFromFileData(path string, data []byte) (*coreauth.Auth, error) {
	if strings.TrimSpace(path) == "" {
		return nil, fmt.Errorf("auth path is empty")
	}
	if data == nil {
		var errRead error
		data, errRead = os.ReadFile(path)
		if errRead != nil {
			return nil, fmt.Errorf("failed to read auth file: %w", errRead)
		}
	}
	metadata := make(map[string]any)
	if errUnmarshal := json.Unmarshal(data, &metadata); errUnmarshal != nil {
		return nil, fmt.Errorf("invalid auth file: %w", errUnmarshal)
	}
	provider, _ := metadata["type"].(string)
	if strings.TrimSpace(provider) == "" {
		provider = "unknown"
	}
	label := provider
	if email, ok := metadata["email"].(string); ok && strings.TrimSpace(email) != "" {
		label = strings.TrimSpace(email)
	}
	authID := h.authIDForPath(path)
	if authID == "" {
		authID = path
	}
	auth := &coreauth.Auth{
		ID:       authID,
		Provider: provider,
		FileName: filepath.Base(path),
		Label:    label,

View on GitHub (pinned to 78f0c4079e)

Solutions

Route writes through the validated save request path so JSON is checked first
Validate with json.Valid(data) before calling buildAuthFromFileData
Repair or regenerate the corrupt source file

Defensive patterns

Strategy: validation

Validate before calling

if !json.Valid(data) {
    return fmt.Errorf("auth data for %s is not valid JSON", path)
}

Try / catch

var synErr *json.SyntaxError
if errors.As(err, &synErr) {
    // locate corruption via offset and regenerate the file
}

Prevention

Route all writes through the validating save path
json.Valid-check fixtures and files before direct build calls

When it happens

Trigger: Save flow whose data bytes are invalid JSON (should normally be pre-caught by validateHostAuthSaveRequest), or a direct buildAuthFromFileData call with corrupt on-disk content.

Common situations: Bypassing the validating save path and calling build directly; file corrupted on disk between validation and build; test fixtures with invalid JSON.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/a44ec339d113627f. Report an issue: GitHub.