Hmbown/CodeWhale · error

agent profile model must be a visible model id without…

Error message

agent profile {} model must be a visible model id without whitespace or secrets

What it means

The optional `model` hint in an agent profile must pass is_model_hint: a plain visible model id without whitespace or anything that looks like a secret. Arbitrary strings (paths, bearer tokens, model names with spaces) are rejected to avoid leaking secrets through profile files.

Solutions

1. Replace the model value with the exact visible model id (no spaces), e.g. "claude-sonnet-4"
2. Remove any credential-looking content from the model field — keys belong in provider config/env, never in the profile
3. Delete the model line if the profile should inherit the workspace default model

Example fix

// before
model = "claude sonnet 4"

// after
model = "claude-sonnet-4"

fn looks_like_model_hint(s: &str) -> bool {
    !s.is_empty() && !s.contains(char::is_whitespace) && !s.contains("sk-") && !s.contains("key")
}
if let Some(m) = &profile.model {
    if !looks_like_model_hint(m) { eprintln!("model must be a plain visible model id"); }
}

match result {
    Err(e) if e.to_string().contains("visible model id") => {
        eprintln!("set model to the exact provider model id without spaces or secrets");
    }
    other => other?,
}

When it happens

Trigger: An agent profile TOML with model = "claude sonnet 4" (spaces), model = "sk-..." or a URL-ish/credential-like string, or any value failing is_model_hint, loaded via agent_profile_from_toml.

Common situations: Writing a human-friendly model name with spaces instead of the provider's model id; pasting an API key or endpoint URL into the model field by mistake; copy-pasting a full provider-qualified string with whitespace.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• agent profile cannot be empty
• agent profile must be a simple token
• agent profile may not disable approval_required
• agent profile may not request allow_shell=true
• agent profile may not request trust=true

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/b44d9bfcc391bcd8. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/fleet/profile.rs:541

    let trimmed = value.trim();
    if trimmed.is_empty() {
        bail!("agent profile {} {field} cannot be empty", path.display());
    }
    if trimmed != value || !trimmed.chars().all(is_agent_profile_token_char) {
        bail!(
            "agent profile {} {field} must be a simple token",
            path.display()
        );
    }
    Ok(())
}

fn validate_agent_profile_model_hint(path: &Path, value: Option<&str>) -> Result<()> {
    let Some(value) = value else {
        return Ok(());
    };
    if !is_model_hint(value) {
        bail!(
            "agent profile {} model must be a visible model id without whitespace or secrets",
            path.display()
        );
    }
    Ok(())
}

/// Validate an explicit `provider` field as a safe provider id (#4093).
///
/// Built-in providers are accepted by the runtime vocabulary, and user-named
/// OpenAI-compatible custom providers are accepted as simple tokens so the
/// launch path can resolve `[providers.<id>]` from the session config (#3965).
/// This field remains the ONLY place a profile's provider is established:
/// callers never infer it from `model` (EPIC #2608).
fn validate_agent_profile_provider(path: &Path, value: &str) -> Result<()> {
    let trimmed = value.trim();
    if trimmed.is_empty() {
        bail!("agent profile {} provider cannot be empty", path.display());

View on GitHub (pinned to 73e0f67d83)