{"record":{"id":"246c017d793cd2bd","repo":"zeroclaw-labs/zeroclaw","slug":"auth-secret-must-contain-only-ascii-letters-numbe","errorCode":null,"errorMessage":"auth_secret must contain only ASCII letters, numbers, underscores, or hyphens","messagePattern":"auth_secret must contain only ASCII letters, numbers, underscores, or hyphens","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/http_request.rs","lineNumber":274,"sourceCode":"                })?;\n                result.insert(header_name, header_value);\n            }\n        }\n        Ok(result)\n    }\n\n    fn validate_secret_name(secret_name: &str) -> anyhow::Result<()> {\n        if secret_name.is_empty() {\n            anyhow::bail!(\"auth_secret cannot be empty\");\n        }\n        if secret_name.len() > 64 {\n            anyhow::bail!(\"auth_secret must be 64 characters or fewer\");\n        }\n        if !secret_name\n            .chars()\n            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')\n        {\n            anyhow::bail!(\n                \"auth_secret must contain only ASCII letters, numbers, underscores, or hyphens\"\n            );\n        }\n        Ok(())\n    }\n\n    fn resolve_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {\n        Self::validate_secret_name(secret_name)?;\n        self.reload_auth_secret(secret_name)\n    }\n\n    fn reload_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {\n        let config_path = self.config_path.as_ref().ok_or_else(|| {\n            anyhow::Error::msg(\"auth_secret requires runtime config reload support\")\n        })?;\n        if config_path.as_os_str().is_empty() {\n            anyhow::bail!(\"auth_secret requires a config.toml path\");\n        }","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/http_request.rs#L256-L292","documentation":"Thrown by HttpRequestTool::validate_secret_name (crates/zeroclaw-tools/src/http_request.rs:274) when the auth_secret name contains any character outside [A-Za-z0-9_-]. Names must be plain ASCII identifiers because they are used as TOML keys and to look up [http_request.secrets] entries. A common cause is passing the secret value, or an env-reference like \"${MY_VAR}\", in the auth_secret argument instead of a bare key name.","triggerScenarios":"auth_secret = \"my.secret\" (dot), \"api/token\" (slash), \"Bearer abc123\" (the raw value), or \"${MY_VAR}\" (braces and $ are invalid; the ${...} form belongs in the config value, not the tool argument); names with spaces or non-ASCII characters.","commonSituations":"Confusing the secret's name with its value; pasting environment-reference syntax into the wrong place; kebab/dot naming habits from other config systems clashing with the allowed alphabet.","solutions":["Pass only the bare key name defined under [http_request.secrets], using letters, digits, underscore, hyphen (e.g. \"api_token\").","To source the value from an environment variable, keep the name simple and set the config value to \"${VAR_NAME}\" instead.","Rename dotted/path-like keys in config.toml to underscore or hyphen forms."],"exampleFix":"# before\n[http_request.secrets]\n\"api.token\" = \"${MY_API_TOKEN}\"\n// caller: {\"auth_secret\": \"${MY_API_TOKEN}\"}\n\n# after\n[http_request.secrets]\napi_token = \"${MY_API_TOKEN}\"\n// caller: {\"auth_secret\": \"api_token\"}","handlingStrategy":"validation","validationCode":"fn secret_name_chars_ok(name: &str) -> bool {\n    !name.is_empty()\n        && name.len() <= 64\n        && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')\n}","typeGuard":"fn is_valid_secret_name(name: &str) -> bool {\n    !name.is_empty()\n        && name.len() <= 64\n        && name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')\n}","tryCatchPattern":"let result = tool.execute(args).await?;\nif let Some(err) = &result.error {\n    if err.contains(\"ASCII letters, numbers, underscores, or hyphens\") {\n        // caller sent a value or ${VAR} reference: use the bare config key name instead\n    }\n}","preventionTips":["auth_secret takes the KEY under [http_request.secrets], never the value or a ${VAR} reference.","Restrict secret keys to [A-Za-z0-9_-] in your config linting.","Put ${ENV_NAME} references only in the secret's value, never in the argument."],"tags":["http","auth","secrets","validation","zeroclaw"],"backgroundTag":"invalid-secret-name","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}