What causes "secret provider %q is configured as null" in larksuite/cli?

Remove the null provider key or give it a full ProviderConfig with a matching source

secret provider %q is configured as null

Error message

secret provider %q is configured as null

What it means

LookupProvider found the named provider key in secrets.providers config but its value is JSON null. A null entry carries no Source and cannot serve a secret ref, so the lookup fails explicitly instead of nil-panicking downstream.

Source

Thrown at internal/binding/types.go:210

		case "exec":
			if cfg.Defaults.Exec != "" {
				return cfg.Defaults.Exec
			}
		}
	}
	return DefaultProviderAlias
}

// LookupProvider resolves a provider config from the registry.
// Returns the provider config or an error if not found.
// Special case: env source with "default" provider returns a synthetic empty env provider.
func LookupProvider(ref *SecretRef, cfg *SecretsConfig) (*ProviderConfig, error) {
	providerName := ResolveDefaultProvider(ref, cfg)

	if cfg != nil && cfg.Providers != nil {
		if pc, ok := cfg.Providers[providerName]; ok {
			if pc == nil {
				return nil, fmt.Errorf("secret provider %q is configured as null", providerName)
			}
			if pc.Source != ref.Source {
				return nil, fmt.Errorf("secret provider %q has source %q but ref requests %q",
					providerName, pc.Source, ref.Source)
			}
			return pc, nil
		}
	}

	// Special case: default env provider (implicit, per OpenClaw resolve.ts)
	if ref.Source == "env" && providerName == DefaultProviderAlias {
		return &ProviderConfig{Source: "env"}, nil
	}

	return nil, fmt.Errorf("secret provider %q is not configured (ref: %s:%s:%s)",
		providerName, ref.Source, providerName, ref.ID)
}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Remove the null provider key or give it a full ProviderConfig with a matching source
Point the ref's `provider` field at an existing, non-null provider
Update refs relying on the default alias to name a configured provider

Example fix

// before
{"secrets": {"providers": {"default": null}}}
// after
{"secrets": {"providers": {"default": {"source": "env"}}}}

Defensive patterns

Strategy: validation

Validate before calling

for name, p := range cfg.Secrets.Providers {
    if p == nil {
        return fmt.Errorf("provider %q is null; remove it or define {source: ...}", name)
    }
}

Prevention

Disable providers by deleting the key, not setting null
Diff config after automated merges to catch injected nulls
Assert providers map contents in a startup config check

When it happens

Trigger: Config like "providers": {"default": null} or an explicitly nulled provider entry that a ref's `provider` field names (including the DefaultProviderAlias).

Common situations: Disabling a provider by setting it to null instead of removing the key; merge tooling or env overlays that write null values; partially migrated config.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/7d3e08bfdc322282. Report an issue: GitHub.