{"record":{"id":"f58dc08e6d430264","repo":"larksuite/cli","slug":"exec-provider-returned-invalid-json-w","errorCode":null,"errorMessage":"exec provider returned invalid JSON: %w","messagePattern":"exec provider returned invalid JSON: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/secret_resolve_exec.go","lineNumber":207,"sourceCode":"\n\ttrimmed := bytes.TrimSpace(stdout.Bytes())\n\tif len(trimmed) == 0 {\n\t\treturn nil, fmt.Errorf(\"exec provider returned empty stdout\")\n\t}\n\treturn trimmed, nil\n}\n\n// extractExecSecret parses stdout as a JSON execResponse and returns the\n// string value at refID. When jsonOnly is false and the response is not valid\n// JSON (or the value is not a string), it falls back to the raw stdout or the\n// JSON encoding of the value respectively — mirroring OpenClaw's resolve.ts.\nfunc extractExecSecret(stdout []byte, refID string, jsonOnly bool) (string, error) {\n\tvar resp execResponse\n\tif err := json.Unmarshal(stdout, &resp); err != nil {\n\t\tif !jsonOnly {\n\t\t\treturn string(stdout), nil\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"exec provider returned invalid JSON: %w\", err)\n\t}\n\n\tif resp.ProtocolVersion != 1 {\n\t\treturn \"\", fmt.Errorf(\"exec provider protocolVersion must be 1, got %d\", resp.ProtocolVersion)\n\t}\n\n\tif refErr, ok := resp.Errors[refID]; ok {\n\t\tmsg := refErr.Message\n\t\tif msg == \"\" {\n\t\t\tmsg = \"unknown error\"\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"exec provider failed for id %q: %s\", refID, msg)\n\t}\n\n\tif resp.Values == nil {\n\t\treturn \"\", fmt.Errorf(\"exec provider response missing 'values'\")\n\t}\n\tvalue, ok := resp.Values[refID]","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/secret_resolve_exec.go#L189-L225","documentation":"extractExecSecret running in jsonOnly mode: stdout did not parse as the expected JSON execResponse and the raw-stdout fallback is disabled for this provider, so resolution fails with the wrapped json.Unmarshal error. (When jsonOnly is false the same input would be accepted as the raw secret.)","triggerScenarios":"Thrown at internal/binding/secret_resolve_exec.go:207 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Make the provider emit the v1 JSON execResponse on stdout","Disable jsonOnly for the provider if raw stdout should be accepted as the secret"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}