{"record":{"id":"028286281b966d7f","repo":"larksuite/cli","slug":"appsecret-is-empty-string","errorCode":null,"errorMessage":"appSecret is empty string","messagePattern":"appSecret is empty string","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/secret_resolve.go","lineNumber":40,"sourceCode":"\t}\n\n\tif input.IsZero() {\n\t\treturn \"\", fmt.Errorf(\"appSecret is missing or empty\")\n\t}\n\n\t// Plain string form (includes env templates)\n\tif input.IsPlain() {\n\t\treturn resolvePlainOrTemplate(input.Plain, getenv)\n\t}\n\n\t// SecretRef object form\n\treturn resolveSecretRef(input.Ref, cfg, getenv)\n}\n\n// resolvePlainOrTemplate handles plain strings and \"${VAR}\" templates.\nfunc resolvePlainOrTemplate(value string, getenv func(string) string) (string, error) {\n\tif value == \"\" {\n\t\treturn \"\", fmt.Errorf(\"appSecret is empty string\")\n\t}\n\n\t// Check for env template pattern: \"${VAR_NAME}\"\n\tmatches := EnvTemplateRe.FindStringSubmatch(value)\n\tif matches != nil {\n\t\tvarName := matches[1]\n\t\tenvValue := getenv(varName)\n\t\tif envValue == \"\" {\n\t\t\treturn \"\", fmt.Errorf(\"env variable %q referenced in openclaw.json is not set or empty\", varName)\n\t\t}\n\t\treturn envValue, nil\n\t}\n\n\t// Plain string: use as-is\n\treturn value, nil\n}\n\n// resolveSecretRef dispatches a SecretRef to the appropriate sub-resolver.","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/secret_resolve.go#L22-L58","documentation":"When ResolveSecretInput receives a plain-string SecretInput, resolvePlainOrTemplate checks the string before env-template expansion. This error means the plain string form was selected (Ref == nil) but the string itself is empty — a literal empty appSecret value like \"\" in openclaw.json. It is distinct from error 161 (no appSecret at all): here the key exists but holds an empty string.","triggerScenarios":"openclaw.json contains \"appSecret\": \"\" (or accounts.<label>.appSecret set to \"\"), so SecretInput{Plain: \"\"} reaches resolvePlainOrTemplate and fails the value == \"\" check. Can also happen when a template engine or script wrote an empty substituted value.","commonSituations":"A placeholder was replaced with nothing during provisioning; a user cleared the secret in the editor but left the key; a CI template rendered ${SECRET} from an unset variable, producing \"appSecret\": \"\".","solutions":["Replace the empty string with the actual app secret value in openclaw.json.","Better: set \"appSecret\": \"${FEISHU_APP_SECRET}\" and export the variable in the environment so the secret is never stored in the file.","In code, pre-validate: if input.IsPlain() && input.Plain == \"\" { reject before resolve }.","If the channel is not yet configured, either remove appSecret (surfacing error 161) or set \"enabled\": false."],"exampleFix":"// before\n\"appSecret\": \"\"\n// after\n\"appSecret\": \"${FEISHU_APP_SECRET}\"","handlingStrategy":"validation","validationCode":"if input.IsPlain() && input.Plain == \"\" {\n\treturn fmt.Errorf(\"openclaw config: appSecret must be a non-empty string or a secret reference\")\n}","typeGuard":"func hasNonEmptyPlainSecret(in binding.SecretInput) bool {\n\treturn in.IsPlain() && in.Plain != \"\"\n}","tryCatchPattern":"secret, err := binding.ResolveSecretInput(input, cfg, os.Getenv)\nif err != nil {\n\tif strings.Contains(err.Error(), \"appSecret is empty string\") {\n\t\treturn fmt.Errorf(\"appSecret in openclaw.json is \\\"\\\"; set the real secret or an env template: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["When substituting template placeholders, assert the substituted value is non-empty before writing the file.","Prefer \"${VAR}\" templates over injecting literal empty strings from unset CI variables.","Add a config pre-flight that flags any \"\" string field for appSecret.","Remove the appSecret key entirely rather than blanking it when rotating."],"tags":["config","secrets","empty-value"],"backgroundTag":"empty-secret-value","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}