larksuite/cli · error

exec provider failed for id %q: %s

Error message

exec provider failed for id %q: %s

What it means

The provider's JSON response carries an error entry for exactly the refID being resolved - the provider itself reported failure for this secret id (its message defaults to 'unknown error' when blank).

Source

Thrown at internal/binding/secret_resolve_exec.go:219

func extractExecSecret(stdout []byte, refID string, jsonOnly bool) (string, error) {
	var resp execResponse
	if err := json.Unmarshal(stdout, &resp); err != nil {
		if !jsonOnly {
			return string(stdout), nil
		}
		return "", fmt.Errorf("exec provider returned invalid JSON: %w", err)
	}

	if resp.ProtocolVersion != 1 {
		return "", fmt.Errorf("exec provider protocolVersion must be 1, got %d", resp.ProtocolVersion)
	}

	if refErr, ok := resp.Errors[refID]; ok {
		msg := refErr.Message
		if msg == "" {
			msg = "unknown error"
		}
		return "", fmt.Errorf("exec provider failed for id %q: %s", refID, msg)
	}

	if resp.Values == nil {
		return "", fmt.Errorf("exec provider response missing 'values'")
	}
	value, ok := resp.Values[refID]
	if !ok {
		return "", fmt.Errorf("exec provider response missing id %q", refID)
	}

	if str, ok := value.(string); ok {
		return str, nil
	}
	if !jsonOnly {
		data, err := json.Marshal(value)
		if err != nil {
			return "", fmt.Errorf("exec provider value for id %q is not JSON-serializable: %w", refID, err)
		}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Address the provider-reported error for that id (missing backend secret, permission failure, etc.)

When it happens

Trigger: Thrown at internal/binding/secret_resolve_exec.go:219 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/4b29b23c7d44d5ec. Report an issue: GitHub.