larksuite/cli · error

exec provider protocolVersion must be 1, got %d

Error message

exec provider protocolVersion must be 1, got %d

What it means

Rejects an exec provider JSON response whose protocolVersion field is not 1. The exec secret protocol only supports version 1; a different value means the provider implements an incompatible protocol revision.

Source

Thrown at internal/binding/secret_resolve_exec.go:211

	}
	return trimmed, nil
}

// extractExecSecret parses stdout as a JSON execResponse and returns the
// string value at refID. When jsonOnly is false and the response is not valid
// JSON (or the value is not a string), it falls back to the raw stdout or the
// JSON encoding of the value respectively — mirroring OpenClaw's resolve.ts.
func extractExecSecret(stdout []byte, refID string, jsonOnly bool) (string, error) {
	var resp execResponse
	if err := json.Unmarshal(stdout, &resp); err != nil {
		if !jsonOnly {
			return string(stdout), nil
		}
		return "", fmt.Errorf("exec provider returned invalid JSON: %w", err)
	}

	if resp.ProtocolVersion != 1 {
		return "", fmt.Errorf("exec provider protocolVersion must be 1, got %d", resp.ProtocolVersion)
	}

	if refErr, ok := resp.Errors[refID]; ok {
		msg := refErr.Message
		if msg == "" {
			msg = "unknown error"
		}
		return "", fmt.Errorf("exec provider failed for id %q: %s", refID, msg)
	}

	if resp.Values == nil {
		return "", fmt.Errorf("exec provider response missing 'values'")
	}
	value, ok := resp.Values[refID]
	if !ok {
		return "", fmt.Errorf("exec provider response missing id %q", refID)
	}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Set protocolVersion to 1 in the provider's JSON response

When it happens

Trigger: Thrown at internal/binding/secret_resolve_exec.go:211 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/56a806ff1522605f. Report an issue: GitHub.