{"record":{"id":"962e1a7a5a9b1489","repo":"Hmbown/CodeWhale","slug":"provider-auth-source-command-must-include-at-least","errorCode":null,"errorMessage":"provider auth source command must include at least one non-empty argv item","messagePattern":"provider auth source command must include at least one non-empty argv item","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/config/src/auth_source.rs","lineNumber":30,"sourceCode":"#[serde(deny_unknown_fields)]\npub struct ProviderAuthSourceToml {\n    #[serde(alias = \"type\")]\n    pub source: AuthSourceKind,\n    #[serde(default, skip_serializing_if = \"Vec::is_empty\")]\n    pub command: Vec<String>,\n    #[serde(default, skip_serializing_if = \"Option::is_none\")]\n    pub timeout_ms: Option<u64>,\n    #[serde(default, skip_serializing_if = \"Option::is_none\")]\n    pub secret_id: Option<String>,\n}\n\nimpl ProviderAuthSourceToml {\n    pub fn validate(&self) -> Result<()> {\n        match self.source {\n            AuthSourceKind::Command => {\n                if self.command.is_empty() || self.command.iter().all(|part| part.trim().is_empty())\n                {\n                    bail!(\n                        \"provider auth source command must include at least one non-empty argv item\"\n                    );\n                }\n            }\n            AuthSourceKind::Secret => {\n                if self\n                    .secret_id\n                    .as_deref()\n                    .is_none_or(|secret_id| secret_id.trim().is_empty())\n                {\n                    bail!(\"provider auth source secret must include secret_id\");\n                }\n            }\n        }\n        Ok(())\n    }\n\n    #[must_use]","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/config/src/auth_source.rs#L12-L48","documentation":"Config validation: a provider auth block declared source = \"command\" must carry a non-empty argv list; ProviderAuthSourceToml::validate() bails when `command` is absent, empty, or contains only whitespace-only strings. This is a fail-fast check at config load/parse time so a broken credential-helper invocation is never attempted.","triggerScenarios":"In config.toml, [providers.<id>.auth] (or the auth-source table) has source = \"command\" together with command = [], command omitted (serde default empty Vec), or entries like command = [\" \", \"\"] — every part trims to empty.","commonSituations":"Hand-editing config.toml and forgetting the argv; templating/YAML-to-TOML generation that emits an empty array; commenting out the command while keeping source = \"command\"; trailing-comma or quoting mistakes producing a single blank string.","solutions":["Set a real argv in config.toml, e.g. command = [\"pass\", \"show\", \"providers/<id>\"]","If you meant to use a stored secret instead, change source = \"secret\" and provide secret_id","Remove the auth block entirely to fall back to environment-variable auth for that provider"],"exampleFix":"# before\n[providers.acme.auth]\nsource = \"command\"\ncommand = []\n\n# after\n[providers.acme.auth]\nsource = \"command\"\ncommand = [\"pass\", \"show\", \"acme/api-key\"]","handlingStrategy":"validation","validationCode":"// Validate the TOML before handing it to Codewhale:\nlet auth: ProviderAuthSourceToml = toml::from_str(&auth_table)?;\nif matches!(auth.source, AuthSourceKind::Command)\n    && (auth.command.is_empty() || auth.command.iter().all(|p| p.trim().is_empty()))\n{\n    anyhow::bail!(\"fix config: command auth needs a non-empty argv\");\n}","typeGuard":null,"tryCatchPattern":"match cfg.validate() {\n    Ok(()) => { /* safe to start */ }\n    Err(e) if e.to_string().contains(\"auth source command\") => {\n        // config authoring error: point at the offending [providers.*.auth] table\n        show_config_hint(\"command = [\\\"pass\\\", \\\"show\\\", \\\"<key>\\\"]\");\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Run the CLI's config check/doctor command after editing auth tables","Template auth blocks from a known-good example with a real argv","Prefer secret_id or env-var auth when you do not have a stable command helper"],"tags":["config","toml","auth","validation"],"backgroundTag":"config-validation-failed","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}