larksuite/cli · error

file provider JSON Pointer %q: %w

Error message

file provider JSON Pointer %q: %w

What it means

The file parsed as JSON, but ReadJSONPointer could not navigate to ref.ID — the pointer targets a missing key, wrong array index, or is malformed. The ref id and the pointer error are wrapped so you can see which path failed.

Source

Thrown at internal/binding/secret_resolve_file.go:92

	case "singleValue":
		// OpenClaw requires ref.id == SINGLE_VALUE_FILE_REF_ID for singleValue mode
		if ref.ID != SingleValueFileRefID {
			return "", fmt.Errorf("singleValue file provider expects ref id %q, got %q",
				SingleValueFileRefID, ref.ID)
		}
		// Entire file content is the secret; trim trailing newline
		return strings.TrimRight(content, "\r\n"), nil

	case "json":
		// Parse as JSON, then navigate via JSON Pointer (ref.ID)
		var parsed interface{}
		if err := json.Unmarshal(data, &parsed); err != nil {
			return "", fmt.Errorf("file provider JSON parse error: %w", err)
		}

		value, err := ReadJSONPointer(parsed, ref.ID)
		if err != nil {
			return "", fmt.Errorf("file provider JSON Pointer %q: %w", ref.ID, err)
		}

		// Value must be a string
		strValue, ok := value.(string)
		if !ok {
			return "", fmt.Errorf("file provider JSON Pointer %q resolved to non-string value", ref.ID)
		}
		return strValue, nil

	default:
		return "", fmt.Errorf("unsupported file provider mode %q", mode)
	}
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Print the file structure (`jq . <path>` or `jq 'paths' <path>`) and set ref.ID to a pointer that exists, e.g. "/api_key".
2. Ensure the pointer starts with "/" and escapes "~" as "~0" and "/" as "~1" per RFC 6901.
3. Update the binding config after any secret-file schema change; keep them versioned together.

Example fix

// before: file is {"secrets":{"token":"x"}}, ref id "/token"
{"source":"file","id":"/token"}
// after
{"source":"file","id":"/secrets/token"}

var doc any
raw, _ := os.ReadFile(os.ExpandEnv(pc.Path))
if json.Unmarshal(raw, &doc) == nil {
    if _, err := ReadJSONPointer(doc, ref.ID); err != nil {
        return fmt.Errorf("ref id %q does not exist in secret file: %v", ref.ID, err)
    }
}

secret, err := resolveSecretRef(ctx, ref)
if err != nil {
    if strings.Contains(err.Error(), "JSON Pointer") {
        // list paths with `jq 'paths' <file>` and correct ref.ID
    }
    return err
}

When it happens

Trigger: Calling resolveSecretRef with a {source:"file"} SecretRef in json mode where ref.ID does not match any location in the parsed document — e.g. id "/apiKey" when the file has "api_key", or "/secrets/0" when the array is empty.

Common situations: Secret file schema changed (renamed keys, added nesting) after the binding config was written; ref id written without the leading "/"; case mismatch between id and JSON key; pointing at an index that no longer exists after rotation.

Related errors

• file provider path is empty
• singleValue file provider expects ref id %q, got %q
• file provider JSON Pointer %q resolved to non-string value
• unsupported file provider mode %q
• appSecret is missing or empty

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/7a1cc4867576e02d. Report an issue: GitHub.