{"record":{"id":"02774ad50b1d013d","repo":"larksuite/cli","slug":"exec-provider-returned-empty-stdout","errorCode":null,"errorMessage":"exec provider returned empty stdout","messagePattern":"exec provider returned empty stdout","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/secret_resolve_exec.go","lineNumber":192,"sourceCode":"\n\tvar stdout, stderr bytes.Buffer\n\tcmd.Stdout = &stdout\n\tcmd.Stderr = &stderr\n\n\tif err := cmd.Run(); err != nil {\n\t\tif ctx.Err() == context.DeadlineExceeded {\n\t\t\treturn nil, fmt.Errorf(\"exec provider timed out after %dms\", int(prep.Timeout/time.Millisecond))\n\t\t}\n\t\treturn nil, fmt.Errorf(\"exec provider exited with error: %w\", err)\n\t}\n\n\tif stdout.Len() > prep.MaxOut {\n\t\treturn nil, fmt.Errorf(\"exec provider output exceeded maxOutputBytes (%d)\", prep.MaxOut)\n\t}\n\n\ttrimmed := bytes.TrimSpace(stdout.Bytes())\n\tif len(trimmed) == 0 {\n\t\treturn nil, fmt.Errorf(\"exec provider returned empty stdout\")\n\t}\n\treturn trimmed, nil\n}\n\n// extractExecSecret parses stdout as a JSON execResponse and returns the\n// string value at refID. When jsonOnly is false and the response is not valid\n// JSON (or the value is not a string), it falls back to the raw stdout or the\n// JSON encoding of the value respectively — mirroring OpenClaw's resolve.ts.\nfunc extractExecSecret(stdout []byte, refID string, jsonOnly bool) (string, error) {\n\tvar resp execResponse\n\tif err := json.Unmarshal(stdout, &resp); err != nil {\n\t\tif !jsonOnly {\n\t\t\treturn string(stdout), nil\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"exec provider returned invalid JSON: %w\", err)\n\t}\n\n\tif resp.ProtocolVersion != 1 {","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/secret_resolve_exec.go#L174-L210","documentation":"Fails when the exec secret provider exits successfully but its stdout is empty after trimming whitespace. The exec protocol requires the provider to print a JSON execResponse (or at least a raw secret) on stdout; empty output means the provider produced nothing resolvable.","triggerScenarios":"Thrown at internal/binding/secret_resolve_exec.go:192 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the provider to write the secret or the JSON execResponse to stdout instead of stderr or nowhere"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}