Enable errorlint errorf and wrap errors with %w where safe

.golangci.yaml

@@ -38,10 +38,10 @@ linters:
     - errorlint
   settings:
     errorlint:
-      # Switching %v to %w changes which errors callers can match with
-      # errors.Is/As (e.g. fs.ErrNotExist, context.Canceled), so it needs
-      # per-site review rather than a bulk fix.
-      errorf: false
+      # errorf is on: switching %v to %w changes which errors callers can
+      # match with errors.Is/As, so keep %v with a nolint reason where the
+      # cause must not be visible to callers.
+      errorf: true
     modernize:
       # omitzero changes JSON wire format for nested structs (unlike omitempty),
       # so each site needs per-site review rather than a bulk rewrite.

bundle/artifacts/build.go

@@ -118,7 +118,7 @@ func doBuild(ctx context.Context, artifactName string, a *config.Artifact) error
 
 	out, err := executor.Exec(ctx, a.BuildCommand)
 	if err != nil {
-		return fmt.Errorf("build failed %s, error: %v, output: %s", artifactName, err, out)
+		return fmt.Errorf("build failed %s, error: %w, output: %s", artifactName, err, out)
 	}
 
 	log.Debugf(ctx, "build output for %s:\n%s", artifactName, out)

bundle/config/mutator/python/python_diagnostics.go

@@ -44,17 +44,17 @@ func parsePythonDiagnostics(input io.Reader) (diag.Diagnostics, error) {
 
 		err := decoder.Decode(&parsedLine)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse diags: %s", err)
+			return nil, fmt.Errorf("failed to parse diags: %w", err)
 		}
 
 		severity, err := convertPythonSeverity(parsedLine.Severity)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse severity: %s", err)
+			return nil, fmt.Errorf("failed to parse severity: %w", err)
 		}
 
 		path, err := convertPythonPath(parsedLine.Path)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse path: %s", err)
+			return nil, fmt.Errorf("failed to parse path: %w", err)
 		}
 		var paths []*structpath.PathNode
 		if path != nil {

bundle/config/mutator/python/python_locations.go

@@ -110,12 +110,12 @@ func parsePythonLocations(bundleRoot string, input io.Reader) (*pythonLocations,
 
 		err := decoder.Decode(&entry)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse python location: %s", err)
+			return nil, fmt.Errorf("failed to parse python location: %w", err)
 		}
 
 		path, err := dyn.NewPathFromString(entry.Path)
 		if err != nil {
-			return nil, fmt.Errorf("failed to parse python location: %s", err)
+			return nil, fmt.Errorf("failed to parse python location: %w", err)
 		}
 
 		// Output can contain both relative paths and absolute paths outside of bundle root.

bundle/config/mutator/resourcemutator/process_static_resources.go

@@ -74,7 +74,7 @@ func getAllResources(b *bundle.Bundle) (ResourceKeySet, error) {
 		return root, nil
 	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to collect resources: %s", err)
+		return nil, fmt.Errorf("failed to collect resources: %w", err)
 	}
 
 	return set, nil

bundle/config/mutator/resourcemutator/resource_mutator.go

@@ -232,7 +232,7 @@ func NormalizeAndInitializeResources(
 		return selectResources(root, addedResources)
 	})
 	if err != nil {
-		logdiag.LogError(ctx, fmt.Errorf("failed to select resources: %s", err))
+		logdiag.LogError(ctx, fmt.Errorf("failed to select resources: %w", err))
 		return
 	}
 
@@ -251,7 +251,7 @@ func NormalizeAndInitializeResources(
 		return mergeResources(root, snapshot)
 	})
 	if err != nil {
-		logdiag.LogError(ctx, fmt.Errorf("failed to merge resources: %s", err))
+		logdiag.LogError(ctx, fmt.Errorf("failed to merge resources: %w", err))
 	}
 }
 
@@ -274,7 +274,7 @@ func NormalizeResources(
 		return selectResources(root, updatedResources)
 	})
 	if err != nil {
-		logdiag.LogError(ctx, fmt.Errorf("failed to select resources: %s", err))
+		logdiag.LogError(ctx, fmt.Errorf("failed to select resources: %w", err))
 		return
 	}
 
@@ -299,7 +299,7 @@ func NormalizeResources(
 		return mergeResources(root, snapshot)
 	})
 	if err != nil {
-		logdiag.LogError(ctx, fmt.Errorf("failed to merge resources: %s", err))
+		logdiag.LogError(ctx, fmt.Errorf("failed to merge resources: %w", err))
 	}
 }
 

bundle/config/mutator/set_variables.go

@@ -45,7 +45,7 @@ func setVariable(ctx context.Context, v dyn.Value, variable *variable.Variable,
 
 		v, err := dyn.Set(v, "value", dyn.V(val))
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf(`failed to assign value "%s" to variable %s from environment variable %s with error: %v`, val, name, envVarName, err)
+			return dyn.InvalidValue, fmt.Errorf(`failed to assign value "%s" to variable %s from environment variable %s with error: %v`, val, name, envVarName, err) //nolint:errorlint // runs inside dyn.Map, which drops wrapped no-such-key errors
 		}
 		return v, nil
 	}
@@ -70,7 +70,7 @@ func setVariable(ctx context.Context, v dyn.Value, variable *variable.Variable,
 
 		v, err := dyn.Set(v, "value", fileDefault)
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf(`failed to assign default value from variable file to variable %s with error: %v`, name, err)
+			return dyn.InvalidValue, fmt.Errorf(`failed to assign default value from variable file to variable %s with error: %v`, name, err) //nolint:errorlint // runs inside dyn.Map, which drops wrapped no-such-key errors
 		}
 
 		return v, nil
@@ -80,12 +80,12 @@ func setVariable(ctx context.Context, v dyn.Value, variable *variable.Variable,
 	if variable.HasDefault() {
 		vDefault, err := dyn.Get(v, "default")
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf(`failed to get default value from config "%s" for variable %s with error: %v`, variable.Default, name, err)
+			return dyn.InvalidValue, fmt.Errorf(`failed to get default value from config "%s" for variable %s with error: %v`, variable.Default, name, err) //nolint:errorlint // runs inside dyn.Map, which drops wrapped no-such-key errors
 		}
 
 		v, err := dyn.Set(v, "value", vDefault)
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf(`failed to assign default value from config "%s" to variable %s with error: %v`, variable.Default, name, err)
+			return dyn.InvalidValue, fmt.Errorf(`failed to assign default value from config "%s" to variable %s with error: %v`, variable.Default, name, err) //nolint:errorlint // runs inside dyn.Map, which drops wrapped no-such-key errors
 		}
 		return v, nil
 	}

bundle/config/root.go

@@ -289,7 +289,7 @@ func (r *Root) InitializeVariables(vars []string) error {
 
 		err := r.Variables[name].Set(val)
 		if err != nil {
-			return fmt.Errorf("failed to assign %s to %s: %s", val, name, err)
+			return fmt.Errorf("failed to assign %s to %s: %w", val, name, err)
 		}
 	}
 	return nil

bundle/deploy/files/delete.go

@@ -66,7 +66,7 @@ func deleteSnapshotFile(ctx context.Context, b *bundle.Bundle) error {
 	}
 	err = os.Remove(sp)
 	if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return fmt.Errorf("failed to destroy sync snapshot file: %s", err)
+		return fmt.Errorf("failed to destroy sync snapshot file: %w", err)
 	}
 	return nil
 }

bundle/statemgmt/state_load.go

@@ -99,7 +99,7 @@ func ensureMap(v dyn.Value, path dyn.Path) (dyn.Value, error) {
 		var err error
 		v, err = dyn.SetByPath(v, path, dyn.V(dyn.NewMapping()))
 		if err != nil {
-			return dyn.InvalidValue, fmt.Errorf("internal error: failed to create %s: %s", path, err)
+			return dyn.InvalidValue, fmt.Errorf("internal error: failed to create %s: %w", path, err)
 		}
 	}
 	return v, nil

experimental/ssh/internal/proxy/server.go

@@ -145,7 +145,7 @@ func (server *proxyServer) handleNewConnection(ctx context.Context, w http.Respo
 func runServerProxy(ctx context.Context, proxy *proxyConnection, createServerCommand createServerCommandFunc, w http.ResponseWriter, r *http.Request) error {
 	err := proxy.accept(w, r)
 	if err != nil {
-		return fmt.Errorf("failed to upgrade to websockets: %v", err)
+		return fmt.Errorf("failed to upgrade to websockets: %w", err)
 	}
 	defer closeProxyConnection(ctx, proxy)
 	log.Infof(ctx, "New connection accepted")
@@ -159,17 +159,17 @@ func runServerProxy(ctx context.Context, proxy *proxyConnection, createServerCom
 
 	sshdStdin, err := serverCmd.StdinPipe()
 	if err != nil {
-		return fmt.Errorf("failed to get stdin pipe: %v", err)
+		return fmt.Errorf("failed to get stdin pipe: %w", err)
 	}
 
 	sshdStdout, err := serverCmd.StdoutPipe()
 	if err != nil {
-		return fmt.Errorf("failed to get stdout pipe: %v", err)
+		return fmt.Errorf("failed to get stdout pipe: %w", err)
 	}
 
 	err = serverCmd.Start()
 	if err != nil {
-		return fmt.Errorf("failed to start SSHD process: %v", err)
+		return fmt.Errorf("failed to start SSHD process: %w", err)
 	}
 	defer releaseServerCommand(ctx, serverCmd)
 

libs/aitools/installer/installer.go

@@ -128,7 +128,7 @@ func resolveLatestSkillsReleaseRef(ctx context.Context) (ref string, explicit bo
 		return "v" + embedded, false, nil
 	}
 	if embeddedErr != nil {
-		return "", false, fmt.Errorf("resolve latest skills release: %w (embedded fallback failed: %v)", err, embeddedErr)
+		return "", false, fmt.Errorf("resolve latest skills release: %w (embedded fallback failed: %v)", err, embeddedErr) //nolint:errorlint // only the primary error belongs in the chain
 	}
 	return "", false, fmt.Errorf("resolve latest skills release: %w", err)
 }
@@ -785,7 +785,7 @@ func replaceDir(destDir, tmpDir string) error {
 	if err := renamePathFn(tmpDir, destDir); err != nil {
 		if backupDest != "" {
 			if restoreErr := renamePathFn(backupDest, destDir); restoreErr != nil {
-				return fmt.Errorf("failed to move skill into place: %w (also failed to restore existing skill: %v)", err, restoreErr)
+				return fmt.Errorf("failed to move skill into place: %w (also failed to restore existing skill: %v)", err, restoreErr) //nolint:errorlint // only the primary error belongs in the chain
 			}
 		}
 		return fmt.Errorf("failed to move skill into place: %w", err)

libs/dyn/jsonloader/json.go

@@ -30,7 +30,7 @@ func LoadJSON(data []byte, source string) (dyn.Value, error) {
 		// Get the current offset for error reporting
 		errorOffset := decoder.InputOffset()
 		errorLocation := offset.GetPosition(errorOffset)
-		return dyn.InvalidValue, fmt.Errorf("error decoding JSON at %s: %v", errorLocation, err)
+		return dyn.InvalidValue, fmt.Errorf("error decoding JSON at %s: %w", errorLocation, err)
 	}
 
 	// Check if there are any remaining tokens (should not be valid JSON)

libs/sync/snapshot.go

@@ -93,7 +93,7 @@ func SnapshotPath(opts *SyncOptions) (string, error) {
 	if _, err := os.Stat(snapshotDir); errors.Is(err, fs.ErrNotExist) {
 		err = os.MkdirAll(snapshotDir, 0o755)
 		if err != nil {
-			return "", fmt.Errorf("failed to create config directory: %s", err)
+			return "", fmt.Errorf("failed to create config directory: %w", err)
 		}
 	}
 	fileName := GetFileName(opts.Host, opts.RemotePath)
@@ -125,10 +125,10 @@ func (s *Snapshot) Save(ctx context.Context) error {
 	// persist snapshot to disk
 	bytes, err := json.MarshalIndent(s, "", "  ")
 	if err != nil {
-		return fmt.Errorf("failed to json marshal in-memory snapshot: %s", err)
+		return fmt.Errorf("failed to json marshal in-memory snapshot: %w", err)
 	}
 	if err := atomicfile.Write(s.snapshotPath, bytes, 0o644); err != nil {
-		return fmt.Errorf("failed to write sync snapshot to disk: %s", err)
+		return fmt.Errorf("failed to write sync snapshot to disk: %v", err) //nolint:errorlint // files.Upload treats fs.ErrPermission as a workspace permission problem; this is a local file
 	}
 	return nil
 }
@@ -146,13 +146,13 @@ func loadOrNewSnapshot(ctx context.Context, opts *SyncOptions) (*Snapshot, error
 
 	bytes, err := os.ReadFile(snapshot.snapshotPath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read sync snapshot from disk: %s", err)
+		return nil, fmt.Errorf("failed to read sync snapshot from disk: %w", err)
 	}
 
 	var fromDisk Snapshot
 	err = json.Unmarshal(bytes, &fromDisk)
 	if err != nil {
-		return nil, fmt.Errorf("failed to json unmarshal persisted snapshot: %s", err)
+		return nil, fmt.Errorf("failed to json unmarshal persisted snapshot: %w", err)
 	}
 
 	// invalidate old snapshot with schema versions
@@ -164,7 +164,7 @@ func loadOrNewSnapshot(ctx context.Context, opts *SyncOptions) (*Snapshot, error
 	// unmarshal again over the existing snapshot instance
 	err = json.Unmarshal(bytes, &snapshot)
 	if err != nil {
-		return nil, fmt.Errorf("failed to json unmarshal persisted snapshot: %s", err)
+		return nil, fmt.Errorf("failed to json unmarshal persisted snapshot: %w", err)
 	}
 
 	// Ensure that all paths are slash-separated upon loading

libs/telemetry/logger.go

@@ -98,7 +98,7 @@ func Upload(ctx context.Context, ec protos.ExecutionContext) error {
 	for i, log := range l.logs {
 		b, err := json.Marshal(log)
 		if err != nil {
-			return fmt.Errorf("failed to marshal log: %s", err)
+			return fmt.Errorf("failed to marshal log: %w", err)
 		}
 		protoLogs[i] = string(b)
 	}

libs/testserver/jobs.go

@@ -800,7 +800,7 @@ func (s *FakeWorkspace) executePythonWheelTask(jobSettings *jobs.JobSettings, ta
 		installArgs := []string{"pip", "install", "-q", "--python", venvPython(env.venvDir)}
 		installArgs = append(installArgs, newWhlPaths...)
 		if out, err := exec.Command("uv", installArgs...).CombinedOutput(); err != nil {
-			return "", fmt.Errorf("uv pip install failed: %s\n%s", err, out)
+			return "", fmt.Errorf("uv pip install failed: %w\n%s", err, out)
 		}
 	}
 
@@ -877,7 +877,7 @@ func (s *FakeWorkspace) executeNotebookTask(task jobs.Task, notebookParams map[s
 	venvDir := filepath.Join(tmpDir, ".venv")
 	uvArgs := []string{"venv", "-q", "--python", pythonVersion, venvDir}
 	if out, err := exec.Command("uv", uvArgs...).CombinedOutput(); err != nil {
-		return "", fmt.Errorf("uv venv failed: %s\n%s", err, out)
+		return "", fmt.Errorf("uv venv failed: %w\n%s", err, out)
 	}
 
 	// Install wheels from %pip commands
@@ -899,7 +899,7 @@ func (s *FakeWorkspace) executeNotebookTask(task jobs.Task, notebookParams map[s
 		installArgs := []string{"pip", "install", "-q", "--python", venvPython(venvDir)}
 		installArgs = append(installArgs, localWhlPaths...)
 		if out, err := exec.Command("uv", installArgs...).CombinedOutput(); err != nil {
-			return "", fmt.Errorf("uv pip install failed: %s\n%s", err, out)
+			return "", fmt.Errorf("uv pip install failed: %w\n%s", err, out)
 		}
 	}
 
@@ -989,7 +989,7 @@ func (s *FakeWorkspace) getOrCreateClusterEnv(task jobs.Task) (*clusterEnv, func
 	uvArgs := []string{"venv", "-q", "--python", pythonVersion, venvDir}
 	if out, err := exec.Command("uv", uvArgs...).CombinedOutput(); err != nil {
 		os.RemoveAll(tmpDir)
-		return nil, nil, fmt.Errorf("uv venv failed: %s\n%s", err, out)
+		return nil, nil, fmt.Errorf("uv venv failed: %w\n%s", err, out)
 	}
 
 	env := &clusterEnv{