{"record":{"id":"2868894149c6c8aa","repo":"different-ai/openwork","slug":"invalid-env-key-286889","errorCode":"invalid_env_key","errorMessage":"Invalid environment variable name","messagePattern":"Invalid environment variable name","errorType":"error_code","errorClass":"ApiError","httpStatus":400,"severity":"error","filePath":"apps/server/src/routes/core.ts","lineNumber":419,"sourceCode":"\n  addRoute(routes, \"PUT\", \"/env/status\", \"host-token\", async (ctx) => {\n    const body = await readJsonBody(ctx.request);\n    const runtimeKey = typeof body.runtimeKey === \"string\" && body.runtimeKey.trim()\n      ? body.runtimeKey.trim()\n      : \"default\";\n    const pendingChanges = body.pendingChanges === true;\n    if (pendingChanges) {\n      envPendingChangesByRuntime.set(runtimeKey, true);\n    } else {\n      envPendingChangesByRuntime.delete(runtimeKey);\n    }\n    return jsonResponse({ runtimeKey, pendingChanges });\n  });\n\n  addRoute(routes, \"GET\", \"/env/:key\", \"host-token\", async (ctx) => {\n    const key = ctx.params.key;\n    if (!isValidEnvKey(key)) {\n      throw new ApiError(400, \"invalid_env_key\", \"Invalid environment variable name\");\n    }\n    const item = (await env.list().catch(rethrowEnvStoreReadError)).find((entry) => entry.key === key);\n    if (!item) {\n      throw new ApiError(404, \"env_not_found\", \"Environment variable not found\");\n    }\n    return jsonResponse({\n      item: {\n        key: item.key,\n        updatedAt: item.updatedAt,\n        hasValue: item.value.length > 0,\n        value: item.value,\n      },\n    });\n  });\n\n  addRoute(routes, \"PUT\", \"/env\", \"host-token\", async (ctx) => {\n    ensureWritable(config);\n    const body = await readJsonBody(ctx.request);","sourceCodeStart":401,"sourceCodeEnd":437,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/apps/server/src/routes/core.ts#L401-L437","documentation":"The GET /env/:key route validates the :key path parameter with isValidEnvKey() and rejects it with a 400 invalid_env_key ApiError when it is not a valid environment variable name. This guards against malformed or malicious keys before the env store is queried. It is purely client-input validation.","triggerScenarios":"Calling GET /env/:key with a key containing characters outside the allowed set (e.g. spaces, '=', '-', unicode, empty string after decoding) or URL-encoding problems where the decoded key is invalid.","commonSituations":"A client builds the URL by string concatenation instead of encodeURIComponent; a key with lowercase/dashes convention from another system (e.g. 'my-var') is rejected; a script iterates keys from a file containing comments or blanks.","solutions":["Use a conventional env key: uppercase letters, digits, and underscores, not starting with a digit (e.g. MY_API_KEY)","URL-encode the key with encodeURIComponent when building the request","Trim whitespace and strip quotes from the key before sending","Rename the variable on the producer side to a valid identifier"],"exampleFix":"// before\nfetch(`/env/${key}`) // key = \"my-var\" -> 400\n// after\nconst valid = /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);\nif (!valid) throw new Error(`invalid env key: ${key}`);\nfetch(`/env/${encodeURIComponent(key)}`)","handlingStrategy":"validation","validationCode":"const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;\nif (!ENV_KEY_RE.test(key)) throw new Error(`invalid env key: ${key}`);","typeGuard":"function isValidEnvKeyName(key: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);\n}","tryCatchPattern":"try {\n  const res = await api.get(`/env/${encodeURIComponent(key)}`);\n} catch (e) {\n  if (e.code === \"invalid_env_key\") throw new Error(`Key \"${key}\" is not a valid env name (use [A-Za-z_][A-Za-z0-9_]*)`);\n  throw e;\n}","preventionTips":["Always encode the key with encodeURIComponent in URLs","Normalize keys to SCREAMING_SNAKE_CASE before sending","Reject dashes, spaces, and leading digits on input in your client","Check the key against the same regex the server uses (isValidEnvKey) before calling"],"tags":["http-400","validation","env","api"],"backgroundTag":"invalid-identifier","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}