{"record":{"id":"24f0c76590772652","repo":"larksuite/cli","slug":"failed-to-read-secret-file-s-w","errorCode":null,"errorMessage":"failed to read secret file %s: %w","messagePattern":"failed to read secret file (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/secret_resolve_file.go","lineNumber":60,"sourceCode":"\t\tAllowReadableByOthers: false, // file provider: strict by default\n\t\tAllowSymlinkPath:      false,\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"file provider security audit failed: %w\", err)\n\t}\n\n\t// Read file content\n\tmaxBytes := pc.MaxBytes\n\tif maxBytes <= 0 {\n\t\tmaxBytes = DefaultFileMaxBytes\n\t}\n\n\t// Note: vfs.ReadFile loads the entire file. maxBytes is enforced post-read\n\t// because vfs does not expose a size-limited reader. For secret files this\n\t// is acceptable (default limit 1 MiB; secrets are typically < 1 KB).\n\tdata, err := vfs.ReadFile(securePath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to read secret file %s: %w\", securePath, err)\n\t}\n\n\tif len(data) > maxBytes {\n\t\treturn \"\", fmt.Errorf(\"file provider exceeded maxBytes (%d)\", maxBytes)\n\t}\n\n\tcontent := string(data)\n\tmode := pc.Mode\n\tif mode == \"\" {\n\t\tmode = \"json\" // default mode per OpenClaw\n\t}\n\n\tswitch mode {\n\tcase \"singleValue\":\n\t\t// OpenClaw requires ref.id == SINGLE_VALUE_FILE_REF_ID for singleValue mode\n\t\tif ref.ID != SingleValueFileRefID {\n\t\t\treturn \"\", fmt.Errorf(\"singleValue file provider expects ref id %q, got %q\",\n\t\t\t\tSingleValueFileRefID, ref.ID)","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/secret_resolve_file.go#L42-L78","documentation":"The file provider could not read the secret file at the audited secure path via vfs.ReadFile. The OS-level error (not found, permission denied, is-a-directory, I/O error) is wrapped in this message along with the audited path.","triggerScenarios":"Calling resolveSecretRef with a {source:\"file\"} SecretRef where the path passed the security audit but the read itself fails — file deleted between audit and read, wrong path after ~ expansion, running as a different user than the file owner, or the path is a directory.","commonSituations":"Typo in the configured path; the secret file was rotated/moved after config was written; `~` expansion points at a different home (e.g. under a service account or container); the file exists but the process user lacks read permission.","solutions":["Verify the path in ProviderConfig.Path exists for the user running the process: `ls -l <path>`.","Check read permissions for the process user (`chmod 600` and correct ownership via chown).","Confirm ~ expands to the expected home (echo $HOME) — service/systemd contexts often differ from your shell.","Recreate the file if it was rotated or moved; inspect the wrapped cause for the exact OS error."],"exampleFix":"// before\npath: ~/secrets/prod.json   // file never created on this host\n// after\nmkdir -p ~/secrets && chmod 700 ~/secrets\nprintf '{\"api_key\":\"...\"}' > ~/secrets/prod.json && chmod 600 ~/secrets/prod.json","handlingStrategy":"try-catch","validationCode":"if _, err := os.Stat(os.ExpandEnv(pc.Path)); err != nil {\n    return fmt.Errorf(\"secret file not accessible before resolve: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"secret, err := resolveSecretRef(ctx, ref)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to read secret file\") {\n        var perr *fs.PathError\n        if errors.As(err, &perr) && errors.Is(perr, fs.ErrNotExist) {\n            return fmt.Errorf(\"secret file missing at %s — create it or fix 'path'\", perr.Path)\n        }\n    }\n    return err\n}","preventionTips":["Provision the secret file (and permissions) as a deployment step before the process starts.","Confirm $HOME in service/systemd/container contexts matches the configured ~ path.","Use atomic writes so rotation never leaves the path temporarily missing."],"tags":["secrets","file-provider","io","file-not-found"],"backgroundTag":"file-not-found","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}