{"record":{"id":"8532038c253432a5","repo":"larksuite/cli","slug":"secret-provider-q-is-not-configured-ref-s-s","errorCode":null,"errorMessage":"secret provider %q is not configured (ref: %s:%s:%s)","messagePattern":"secret provider %q is not configured \\(ref: (.+?):(.+?):(.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/types.go","lineNumber":225,"sourceCode":"\tif cfg != nil && cfg.Providers != nil {\n\t\tif pc, ok := cfg.Providers[providerName]; ok {\n\t\t\tif pc == nil {\n\t\t\t\treturn nil, fmt.Errorf(\"secret provider %q is configured as null\", providerName)\n\t\t\t}\n\t\t\tif pc.Source != ref.Source {\n\t\t\t\treturn nil, fmt.Errorf(\"secret provider %q has source %q but ref requests %q\",\n\t\t\t\t\tproviderName, pc.Source, ref.Source)\n\t\t\t}\n\t\t\treturn pc, nil\n\t\t}\n\t}\n\n\t// Special case: default env provider (implicit, per OpenClaw resolve.ts)\n\tif ref.Source == \"env\" && providerName == DefaultProviderAlias {\n\t\treturn &ProviderConfig{Source: \"env\"}, nil\n\t}\n\n\treturn nil, fmt.Errorf(\"secret provider %q is not configured (ref: %s:%s:%s)\",\n\t\tproviderName, ref.Source, providerName, ref.ID)\n}\n\n// CandidateApp represents a bindable app from OpenClaw's feishu channel config.\ntype CandidateApp struct {\n\tLabel     string\n\tAppID     string\n\tAppSecret SecretInput\n\tBrand     string\n}\n\n// ListCandidateApps enumerates all bindable (enabled) apps from a FeishuChannel.\n// Disabled accounts (enabled: false) are filtered out.\nfunc ListCandidateApps(ch *FeishuChannel) []CandidateApp {\n\tif ch == nil {\n\t\treturn nil\n\t}\n\tif len(ch.Accounts) > 0 {","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/types.go#L207-L243","documentation":"LookupProvider returns this when the named provider (explicit or the default alias) is absent from secrets.providers and the ref is not the special-case implicit default env ref. The message echoes the full ref (source:provider:id) to make the missing binding diagnosable.","triggerScenarios":"A ref with provider \"myvault\" when providers has no \"myvault\" key; a non-env ref relying on the default alias with no default provider configured.","commonSituations":"Renamed provider sections in config; config file not loaded (wrong profile/path); refs copied between projects with different provider sets.","solutions":["Add the named provider to secrets.providers with the matching source","Remove or correct the ref's `provider` field (env refs fall back to the implicit default env provider)","Verify the intended config file is actually being loaded"],"exampleFix":"// before\n{\"source\": \"exec\", \"id\": \"tok\", \"provider\": \"myvault\"} // myvault missing\n// after\n{\"secrets\": {\"providers\": {\"myvault\": {\"source\": \"exec\"}}}} or {\"source\": \"exec\", \"id\": \"tok\"} with a configured default","handlingStrategy":"validation","validationCode":"for _, ref := range refs {\n    if ref.Provider != \"\" && ref.Provider != \"default\" {\n        if _, ok := cfg.Secrets.Providers[ref.Provider]; !ok {\n            return fmt.Errorf(\"provider %q referenced but not configured\", ref.Provider)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep provider definitions and refs in the same config file/layer","Env refs may rely on the implicit default; non-env refs must name a configured provider","Log the effective providers map at startup in debug mode"],"tags":["config","secrets","providers"],"backgroundTag":"provider-not-configured","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}