hashicorp/terraform · critical

Unexpected command type in confirmProviderIsTrusted; this is

Error message

Unexpected command type in confirmProviderIsTrusted; this is a bug in Terraform and should be reported.

What it means

Programmer-error panic in confirmProviderIsTrusted: during non-interactive safe-init handling, the command value passed in is neither *InitCommand nor *StateMigrateCommand. Because the trust/lock-file guidance text is command-specific, the default branch panics rather than guessing. Message explicitly says it is a Terraform bug.

Source

Thrown at internal/command/meta_backend.go:3168

					lockfileProblem = "Terraform used the working directory's lock file by default, but it was empty or did not exist."
				default:
					// Default lock file used, and it exists/has locks in it.
					lockfileProblem = "Terraform used the working directory's lock file by default, but it did not contain a lock for the state store provider."
				}

				var guidance string
				var remediationInstructions string
				switch command.(type) {
				case *InitCommand:
					guidance = `When performing a "terraform init" command in automation, make sure to supply a lock file for the state store provider using the -state-provider-lock-file flag.`
					remediationInstructions = `To fix this, create a minimal configuration containing the specific provider version(s) you need and then perform "terraform init" with input enabled. Check the contents of the lock file created by that command and then retry "terraform init -state-provider-lock-file=<path to lockfile>".
`
				case *StateMigrateCommand:
					guidance = `When performing a "terraform state migrate" command in automation, make sure to supply a lock file for the source and/or destination state store providers using -source-provider-lock-file and/or -destination-provider-lock-file flags.`
					remediationInstructions = `To fix this, create a minimal configuration(s) containing the specific provider version(s) you need and then perform "terraform init" with input enabled. Check the contents of the lock file created by that command and then retry "terraform state migrate -source-provider-lock-file=<path to lockfile> -destination-provider-lock-file=<path to lockfile>".`

				default:
					panic("Unexpected command type in confirmProviderIsTrusted; this is a bug in Terraform and should be reported.")
				}

				diags = diags.Append(tfdiags.Sourceless(
					tfdiags.Error,
					"Missing lock for state store provider",
					fmt.Sprintf(`Terraform is initializing a state store for the first time in a non-interactive mode but no lock was found for the state store provider.
%s

%s

%s`,
						lockfileProblem,
						guidance,
						remediationInstructions,
					),
				))
				return diags
			}

View on GitHub (pinned to d32a084675)

Solutions

1. Report as a Terraform bug; include the command you ran.
2. Run the equivalent terraform init in interactive mode (with input enabled) as a workaround.
3. Supply the state-store provider lock file via -state-provider-lock-file so the non-interactive branch is avoided.

Example fix

// before (library code)
default:
    panic("Unexpected command type in confirmProviderIsTrusted; this is a bug in Terraform and should be reported.")

// after (defensive)
default:
    return diags.Append(tfdiags.Sourceless(tfdiags.Error, "Unsupported command for state store trust approval", "..."))

// Defensive: degrade to a generic error instead of panicking
defer func() {
    if r := recover(); r != nil {
        diags = diags.Append(tfdiags.Sourceless(tfdiags.Error, "Unsupported command", fmt.Sprintf("%v", r)))
    }
}()

When it happens

Trigger: A code path that triggers the RequiresApproval + non-interactive branch from a command type other than Init or StateMigrate (e.g. a new state-related command added without updating this switch).

Common situations: Internal Terraform refactor introducing a new command that reaches state-store init approval; or invoking confirmProviderIsTrusted with a wrapped/aliased command type.

Related errors

• When installing providers described in the config Terraform
• nil config passed to StateStoreProviderFactoryFromConfigStat
• init (determineIfProviderTrusted): unexpected provider locat
• errStateStoreInitDiag requires a non-nil reason argument
• confirmFunc must not be nil

AI-assisted analysis of hashicorp/terraform@d32a084675 (2026-08-11). Data as JSON: /api/errors/938c57d01f3de259. Report an issue: GitHub.