Hmbown/CodeWhale · error · anyhow::Error

provider auth source command must include at least one non-e

Error message

provider auth source command must include at least one non-empty argv item

What it means

Config validation: a provider auth block declared source = "command" must carry a non-empty argv list; ProviderAuthSourceToml::validate() bails when `command` is absent, empty, or contains only whitespace-only strings. This is a fail-fast check at config load/parse time so a broken credential-helper invocation is never attempted.

Source

Thrown at crates/config/src/auth_source.rs:30

#[serde(deny_unknown_fields)]
pub struct ProviderAuthSourceToml {
    #[serde(alias = "type")]
    pub source: AuthSourceKind,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub command: Vec<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub timeout_ms: Option<u64>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secret_id: Option<String>,
}

impl ProviderAuthSourceToml {
    pub fn validate(&self) -> Result<()> {
        match self.source {
            AuthSourceKind::Command => {
                if self.command.is_empty() || self.command.iter().all(|part| part.trim().is_empty())
                {
                    bail!(
                        "provider auth source command must include at least one non-empty argv item"
                    );
                }
            }
            AuthSourceKind::Secret => {
                if self
                    .secret_id
                    .as_deref()
                    .is_none_or(|secret_id| secret_id.trim().is_empty())
                {
                    bail!("provider auth source secret must include secret_id");
                }
            }
        }
        Ok(())
    }

    #[must_use]

View on GitHub (pinned to 0c42157ee5)

Solutions

Set a real argv in config.toml, e.g. command = ["pass", "show", "providers/<id>"]
If you meant to use a stored secret instead, change source = "secret" and provide secret_id
Remove the auth block entirely to fall back to environment-variable auth for that provider

Example fix

# before
[providers.acme.auth]
source = "command"
command = []

# after
[providers.acme.auth]
source = "command"
command = ["pass", "show", "acme/api-key"]

Defensive patterns

Strategy: validation

Validate before calling

// Validate the TOML before handing it to Codewhale:
let auth: ProviderAuthSourceToml = toml::from_str(&auth_table)?;
if matches!(auth.source, AuthSourceKind::Command)
    && (auth.command.is_empty() || auth.command.iter().all(|p| p.trim().is_empty()))
{
    anyhow::bail!("fix config: command auth needs a non-empty argv");
}

Try / catch

match cfg.validate() {
    Ok(()) => { /* safe to start */ }
    Err(e) if e.to_string().contains("auth source command") => {
        // config authoring error: point at the offending [providers.*.auth] table
        show_config_hint("command = [\"pass\", \"show\", \"<key>\"]");
    }
    Err(e) => return Err(e),
}

Prevention

Run the CLI's config check/doctor command after editing auth tables
Template auth blocks from a known-good example with a real argv
Prefer secret_id or env-var auth when you do not have a stable command helper

When it happens

Trigger: In config.toml, [providers.<id>.auth] (or the auth-source table) has source = "command" together with command = [], command omitted (serde default empty Vec), or entries like command = [" ", ""] — every part trims to empty.

Common situations: Hand-editing config.toml and forgetting the argv; templating/YAML-to-TOML generation that emits an empty array; commenting out the command while keeping source = "command"; trailing-comma or quoting mistakes producing a single blank string.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/962e1a7a5a9b1489. Report an issue: GitHub.