larksuite/cli · error

file provider JSON Pointer %q resolved to non-string value

Error message

file provider JSON Pointer %q resolved to non-string value

What it means

The JSON Pointer resolved successfully, but the value it found is not a JSON string (e.g. a number, boolean, object, array, or null). The provider only accepts string secrets, so a non-string at the pointer location is rejected rather than coerced.

Source

Thrown at internal/binding/secret_resolve_file.go:98

		// Entire file content is the secret; trim trailing newline
		return strings.TrimRight(content, "\r\n"), nil

	case "json":
		// Parse as JSON, then navigate via JSON Pointer (ref.ID)
		var parsed interface{}
		if err := json.Unmarshal(data, &parsed); err != nil {
			return "", fmt.Errorf("file provider JSON parse error: %w", err)
		}

		value, err := ReadJSONPointer(parsed, ref.ID)
		if err != nil {
			return "", fmt.Errorf("file provider JSON Pointer %q: %w", ref.ID, err)
		}

		// Value must be a string
		strValue, ok := value.(string)
		if !ok {
			return "", fmt.Errorf("file provider JSON Pointer %q resolved to non-string value", ref.ID)
		}
		return strValue, nil

	default:
		return "", fmt.Errorf("unsupported file provider mode %q", mode)
	}
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Point ref.ID at the specific string field, e.g. "/credentials/password" instead of "/credentials".
2. Quote the value in the secret file so it is a JSON string: "8080" instead of 8080.
3. Store numbers/booleans outside the secret provider if they are not actual secrets.

Example fix

// before: file is {"port": 8080}, ref id "/port"
// after
{"port": "8080"}
// or target the string field: {"db":{"password":"s3cret"}} with id "/db/password"

var doc map[string]any
raw, _ := os.ReadFile(os.ExpandEnv(pc.Path))
if json.Unmarshal(raw, &doc) == nil {
    if v, err := ReadJSONPointer(doc, ref.ID); err == nil {
        if _, ok := v.(string); !ok {
            return fmt.Errorf("ref %q must point at a JSON string, got %T", ref.ID, v)
        }
    }
}

func isJSONString(v any) bool { _, ok := v.(string); return ok }

secret, err := resolveSecretRef(ctx, ref)
if err != nil {
    if strings.Contains(err.Error(), "non-string value") {
        // deepen the pointer or quote the value in the file
    }
    return err
}

When it happens

Trigger: Calling resolveSecretRef with a {source:"file"} SecretRef in json mode where ref.ID points at a numeric, boolean, null, or nested value — e.g. id "/port" resolving to 8080, or "/credentials" resolving to an object.

Common situations: Pointing at numeric fields (ports, TTLs, key versions) or booleans; YAML-authored secrets that got converted to native types; credentials blobs stored as nested objects with the pointer aimed one level too high.

Related errors

• file provider JSON Pointer %q: %w
• exec provider value for id %q is not a string
• file provider path is empty
• file provider security audit failed: %w
• failed to read secret file %s: %w

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/c87a7951b2bf69b4. Report an issue: GitHub.