Function resolveExecRef

internal/binding/secret_resolve_exec.go:52–62

resolveExecRef handles {source:"exec"} SecretRef resolution. It audits the command path, runs the child under a timeout with a hard stdout cap, and extracts the secret from the JSON response. providerName is the caller- resolved effective alias (honours secrets.defaults.exec from openclaw.json).

(ref *SecretRef, providerName string, pc *ProviderConfig, getenv func(string) string)

// extracts the secret from the JSON response. providerName is the caller-
// resolved effective alias (honours secrets.defaults.exec from openclaw.json).
func resolveExecRef(ref *SecretRef, providerName string, pc *ProviderConfig, getenv func(string) string) (string, error) {
	prep, err := prepareExecRun(ref, providerName, pc, getenv)
	if err != nil {
		return "", err
	}
	stdout, err := runExecCommand(prep)
	if err != nil {
		return "", err
	}
	return extractExecSecret(stdout, ref.ID, effectiveJSONOnly(pc))
}

// prepareExecRun audits the command path, marshals the JSON request,
// assembles the minimal child env, and resolves timeout / output limits.