Hmbown/CodeWhale · error

provider auth source command must include at least one…

Error message

provider auth source command must include at least one non-empty argv item

What it means

Validation error from ProviderAuthSourceToml::validate for command-based auth sources. When source = "command", the command field is the argv used to obtain credentials; it must contain at least one entry with non-whitespace content, otherwise the provider config is unusable and load-time validation fails.

Solutions

1. Set command to a real argv, e.g. command = ["op", "read", "op://vault/item/credential"].
2. If credentials come from a secret reference instead, change source to Secret and set secret_id.
3. Remove surrounding whitespace-only entries from the command array.
4. Run the config validator (or CLI startup) again after editing to confirm the fix.

Example fix

// before
[[providers]]
[providers.auth_source]
source = "command"
command = []
// after
[[providers]]
[providers.auth_source]
source = "command"
command = ["pass", "show", "codewhale/api-key"]

// Pre-validate the auth source before handing the config to the library
if auth_source.source == "command"
    && auth_source.command.iter().all(|p| p.trim().is_empty()) {
    return Err("providers.auth_source.command must list a real argv".into());
}

When it happens

Trigger: A provider's auth source in the TOML config is declared as kind Command with command = [] or command = ["", " "] (empty or whitespace-only argv).

Common situations: Hand-editing the config and leaving the command array empty; templating that produced an empty argv; commenting out the command items but keeping the Command kind.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• provider auth source secret must include secret_id
• agent profile provider cannot be empty
• agent profile provider must be a simple provider id
• api_key cannot be empty string
• app-server auth token cannot be empty

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/962e1a7a5a9b1489. Report an issue: GitHub.

Appendix: source

Thrown at crates/config/src/auth_source.rs:30

#[serde(deny_unknown_fields)]
pub struct ProviderAuthSourceToml {
    #[serde(alias = "type")]
    pub source: AuthSourceKind,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub command: Vec<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub timeout_ms: Option<u64>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secret_id: Option<String>,
}

impl ProviderAuthSourceToml {
    pub fn validate(&self) -> Result<()> {
        match self.source {
            AuthSourceKind::Command => {
                if self.command.is_empty() || self.command.iter().all(|part| part.trim().is_empty())
                {
                    bail!(
                        "provider auth source command must include at least one non-empty argv item"
                    );
                }
            }
            AuthSourceKind::Secret => {
                if self
                    .secret_id
                    .as_deref()
                    .is_none_or(|secret_id| secret_id.trim().is_empty())
                {
                    bail!("provider auth source secret must include secret_id");
                }
            }
        }
        Ok(())
    }

    #[must_use]

View on GitHub (pinned to 73e0f67d83)