larksuite/cli · error

exec provider output exceeded maxOutputBytes (%d)

Error message

exec provider output exceeded maxOutputBytes (%d)

What it means

Fails an exec secret-provider subprocess whose stdout exceeded the configured byte cap (prep.MaxOut) after a successful exit. Fires when the provider emits more output than the resolver will accept, preventing unbounded memory use; the caller should shrink provider output or raise maxOutputBytes.

Source

Thrown at internal/binding/secret_resolve_exec.go:187

	cmd := exec.CommandContext(ctx, prep.Path, prep.Args...)
	cmd.Dir = filepath.Dir(prep.Path)
	cmd.Env = prep.Env // always set — leaving nil would inherit the parent env
	cmd.Stdin = bytes.NewReader(prep.Request)

	var stdout, stderr bytes.Buffer
	cmd.Stdout = &stdout
	cmd.Stderr = &stderr

	if err := cmd.Run(); err != nil {
		if ctx.Err() == context.DeadlineExceeded {
			return nil, fmt.Errorf("exec provider timed out after %dms", int(prep.Timeout/time.Millisecond))
		}
		return nil, fmt.Errorf("exec provider exited with error: %w", err)
	}

	if stdout.Len() > prep.MaxOut {
		return nil, fmt.Errorf("exec provider output exceeded maxOutputBytes (%d)", prep.MaxOut)
	}

	trimmed := bytes.TrimSpace(stdout.Bytes())
	if len(trimmed) == 0 {
		return nil, fmt.Errorf("exec provider returned empty stdout")
	}
	return trimmed, nil
}

// extractExecSecret parses stdout as a JSON execResponse and returns the
// string value at refID. When jsonOnly is false and the response is not valid
// JSON (or the value is not a string), it falls back to the raw stdout or the
// JSON encoding of the value respectively — mirroring OpenClaw's resolve.ts.
func extractExecSecret(stdout []byte, refID string, jsonOnly bool) (string, error) {
	var resp execResponse
	if err := json.Unmarshal(stdout, &resp); err != nil {
		if !jsonOnly {
			return string(stdout), nil

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Reduce the provider's stdout output
2. Raise the configured maxOutputBytes ceiling for that provider

When it happens

Trigger: Thrown at internal/binding/secret_resolve_exec.go:187 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/4418ce3e44a7ff17. Report an issue: GitHub.