larksuite/cli · error

exec provider timed out after %dms

Error message

exec provider timed out after %dms

What it means

runExecCommand launched the external secret-provider command and cmd.Run failed while the context deadline (prep.Timeout) had expired - the provider process did not finish within its allotted budget. Terminal for that resolution attempt; distinct from a provider exit error.

Source

Thrown at internal/binding/secret_resolve_exec.go:181

//   - non-zero exit → wrapped *exec.ExitError
//   - stdout exceeds prep.MaxOut → typed error (size enforced post-Run)
//   - empty trimmed stdout → typed error
func runExecCommand(prep *execRun) ([]byte, error) {
	ctx, cancel := context.WithTimeout(context.Background(), prep.Timeout)
	defer cancel()

	cmd := exec.CommandContext(ctx, prep.Path, prep.Args...)
	cmd.Dir = filepath.Dir(prep.Path)
	cmd.Env = prep.Env // always set — leaving nil would inherit the parent env
	cmd.Stdin = bytes.NewReader(prep.Request)

	var stdout, stderr bytes.Buffer
	cmd.Stdout = &stdout
	cmd.Stderr = &stderr

	if err := cmd.Run(); err != nil {
		if ctx.Err() == context.DeadlineExceeded {
			return nil, fmt.Errorf("exec provider timed out after %dms", int(prep.Timeout/time.Millisecond))
		}
		return nil, fmt.Errorf("exec provider exited with error: %w", err)
	}

	if stdout.Len() > prep.MaxOut {
		return nil, fmt.Errorf("exec provider output exceeded maxOutputBytes (%d)", prep.MaxOut)
	}

	trimmed := bytes.TrimSpace(stdout.Bytes())
	if len(trimmed) == 0 {
		return nil, fmt.Errorf("exec provider returned empty stdout")
	}
	return trimmed, nil
}

// extractExecSecret parses stdout as a JSON execResponse and returns the
// string value at refID. When jsonOnly is false and the response is not valid
// JSON (or the value is not a string), it falls back to the raw stdout or the

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Make the provider exit faster (cache secrets, avoid interactive prompts)
2. Raise the exec provider timeout configuration if a longer budget is acceptable

When it happens

Trigger: Thrown at internal/binding/secret_resolve_exec.go:181 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/679052364d4e791f. Report an issue: GitHub.