larksuite/cli · error

exec provider returned invalid JSON: %w

Error message

exec provider returned invalid JSON: %w

What it means

extractExecSecret running in jsonOnly mode: stdout did not parse as the expected JSON execResponse and the raw-stdout fallback is disabled for this provider, so resolution fails with the wrapped json.Unmarshal error. (When jsonOnly is false the same input would be accepted as the raw secret.)

Source

Thrown at internal/binding/secret_resolve_exec.go:207

	trimmed := bytes.TrimSpace(stdout.Bytes())
	if len(trimmed) == 0 {
		return nil, fmt.Errorf("exec provider returned empty stdout")
	}
	return trimmed, nil
}

// extractExecSecret parses stdout as a JSON execResponse and returns the
// string value at refID. When jsonOnly is false and the response is not valid
// JSON (or the value is not a string), it falls back to the raw stdout or the
// JSON encoding of the value respectively — mirroring OpenClaw's resolve.ts.
func extractExecSecret(stdout []byte, refID string, jsonOnly bool) (string, error) {
	var resp execResponse
	if err := json.Unmarshal(stdout, &resp); err != nil {
		if !jsonOnly {
			return string(stdout), nil
		}
		return "", fmt.Errorf("exec provider returned invalid JSON: %w", err)
	}

	if resp.ProtocolVersion != 1 {
		return "", fmt.Errorf("exec provider protocolVersion must be 1, got %d", resp.ProtocolVersion)
	}

	if refErr, ok := resp.Errors[refID]; ok {
		msg := refErr.Message
		if msg == "" {
			msg = "unknown error"
		}
		return "", fmt.Errorf("exec provider failed for id %q: %s", refID, msg)
	}

	if resp.Values == nil {
		return "", fmt.Errorf("exec provider response missing 'values'")
	}
	value, ok := resp.Values[refID]

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Make the provider emit the v1 JSON execResponse on stdout
2. Disable jsonOnly for the provider if raw stdout should be accepted as the secret

When it happens

Trigger: Thrown at internal/binding/secret_resolve_exec.go:207 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/f58dc08e6d430264. Report an issue: GitHub.