{"record":{"id":"3c42ddf1ac3da394","repo":"vercel/ai","slug":"acp-credentialenv-and-credentialbrokering-must-be","errorCode":null,"errorMessage":"ACP credentialEnv and credentialBrokering must be configured together.","messagePattern":"ACP credentialEnv and credentialBrokering must be configured together\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/harness-acp/src/acp-harness.ts","lineNumber":125,"sourceCode":"    .optional(),\n  restoration: z\n    .object({\n      method: z.enum(['resume', 'load']),\n    })\n    .optional(),\n  initialGuidanceApplied: z.boolean().optional(),\n  instructionsFingerprint: z.string().optional(),\n  skillsDirectory: z.string().optional(),\n});\n\nexport function createACP<TBuiltinTools extends ToolSet = {}>(\n  settings: ACPHarnessSettings<TBuiltinTools>,\n): HarnessV1<TBuiltinTools> {\n  if (\n    (settings.credentialEnv == null) !==\n    (settings.credentialBrokering == null)\n  ) {\n    throw new Error(\n      'ACP credentialEnv and credentialBrokering must be configured together.',\n    );\n  }\n  if (\n    settings.mcpServers != null &&\n    Object.prototype.hasOwnProperty.call(\n      settings.mcpServers,\n      'ai-sdk-harness-tools',\n    )\n  ) {\n    throw new Error(\n      'ACP MCP server name \"ai-sdk-harness-tools\" is reserved for HarnessAgent tools.',\n    );\n  }\n  const version = (settings as { readonly version?: string }).version ?? 'v1';\n  switch (version) {\n    case 'v1': {\n      const clientApp = settings.clientApp ?? ACP_CLIENT_APP;","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/harness-acp/src/acp-harness.ts#L107-L143","documentation":"createACP validates that the optional credentialEnv and credentialBrokering settings are supplied as a pair. These two options together define how sandbox credentials are exposed to the agent process; providing only one leaves credential brokering half-configured, so the harness rejects the settings up front rather than failing later at runtime.","triggerScenarios":"Calling createACP (or a wrapper like createCodexACP, createCursorACP, claudeCodeACPHarness) with settings that set credentialEnv but not credentialBrokering, or credentialBrokering but not credentialEnv.","commonSituations":"Copying a config snippet that only showed one of the two options; removing brokering config during refactor while leaving credentialEnv; wiring sandbox credential injection incrementally and forgetting the second half.","solutions":["Add the matching credentialBrokering configuration alongside credentialEnv.","If brokering is not intended, remove credentialEnv (or set both to undefined) so the pair is consistent.","Check the wrapper factory you call (createCodexACP etc.) for defaults that may inject one option without the other."],"exampleFix":"// before\ncreateACP({ credentialEnv: { API_KEY: '...' } }); // throws\n// after\ncreateACP({\n  credentialEnv: { API_KEY: '...' },\n  credentialBrokering: { mode: 'sandbox' }, // pair supplied\n});","handlingStrategy":"validation","validationCode":"function validateCredentialPair(settings: { credentialEnv?: unknown; credentialBrokering?: unknown }): void {\n  if ((settings.credentialEnv == null) !== (settings.credentialBrokering == null)) {\n    throw new Error('credentialEnv and credentialBrokering must be set together.');\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Define credential settings as a single object containing both fields so they cannot drift apart.","Add a unit test covering both-supplied and both-absent settings.","Review wrapper factories for defaults that set only one option."],"tags":["configuration","validation","acp"],"backgroundTag":"invalid-configuration","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}