google_workspace.allowed_operations[{i}].sub_resource must n

Error message

google_workspace.allowed_operations[{i}].sub_resource must not be empty when present

What it means

When an allowed_operations entry sets the optional `sub_resource` key, Config::validate() requires the trimmed value to be non-empty. An empty Some("") is worse than absent: it produces a malformed service.resource. tool key at runtime, so the validator rejects it at load time (the key is simply dropped if not present at all).

Source

Thrown at crates/zeroclaw-config/src/schema.rs:21881

                    "google_workspace.allowed_operations[{i}].service contains invalid characters: {service}"
                );
            }
            // Unlike service IDs, resource/sub_resource/method names are camelCase
            // in the Google APIs (calendarList, quickAdd, batchUpdate), so
            // uppercase must be accepted here and in the runtime tool check.
            if !resource
                .chars()
                .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
            {
                anyhow::bail!(
                    "google_workspace.allowed_operations[{i}].resource contains invalid characters: {resource}"
                );
            }

            if let Some(ref sub_resource) = operation.sub_resource {
                let sub = sub_resource.trim();
                if sub.is_empty() {
                    anyhow::bail!(
                        "google_workspace.allowed_operations[{i}].sub_resource must not be empty when present"
                    );
                }
                if !sub
                    .chars()
                    .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
                {
                    anyhow::bail!(
                        "google_workspace.allowed_operations[{i}].sub_resource contains invalid characters: {sub}"
                    );
                }
            }

            if operation.methods.is_empty() {
                validation_bail!(
                    RequiredFieldEmpty,
                    format!("google_workspace.allowed_operations[{i}].methods"),
                    "google_workspace.allowed_operations[{i}].methods must not be empty"

View on GitHub (pinned to 88bb9c8533)

Solutions

Delete the sub_resource key entirely if no sub-resource filter is wanted
Otherwise set it to the real sub-resource name (e.g. "attachments" for drive/files)
Trim accidental whitespace and re-validate the config

Example fix

# before
[[google_workspace.allowed_operations]]
service = "drive"
resource = "files"
sub_resource = ""
methods = ["get"]

# after
[[google_workspace.allowed_operations]]
service = "drive"
resource = "files"
methods = ["get"]

Defensive patterns

Strategy: validation

Validate before calling

fn has_valid_sub_resource(op: &GwsOperation) -> bool {
    op.sub_resource.as_deref().map(|s| !s.trim().is_empty()).unwrap_or(true)
}

Type guard

fn sub_resource_ok(sub: Option<&str>) -> bool {
    sub.map(|s| !s.trim().is_empty()).unwrap_or(true)
}

Try / catch

match config.validate() {
    Ok(()) => {}
    Err(e) if e.to_string().contains("sub_resource must not be empty when present") => {
        // delete the key or give it a real value, then re-validate
    }
    Err(e) => return Err(e),
}

Prevention

Prefer omitting optional keys over writing empty strings in TOML
When templating configs, delete placeholder keys rather than blanking them

When it happens

Trigger: An entry containing sub_resource = "" or sub_resource = " " under [[google_workspace.allowed_operations]] when Config::validate() is called.

Common situations: Uncommenting a template line but leaving the placeholder empty; switching a resource-scoped entry to service-wide by blanking sub_resource instead of deleting the key; trailing-whitespace-only values from copy-paste.

Related errors

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/fc9b339c93d2ef93. Report an issue: GitHub.