{"record":{"id":"4b70f61224f470ff","repo":"astrid-runtime/astrid","slug":"scope-shared-is-only-valid-for-manifest-declared","errorCode":null,"errorMessage":"--scope=shared is only valid for manifest-declared secrets","messagePattern":"--scope=shared is only valid for manifest-declared secrets","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/secret.rs","lineNumber":321,"sourceCode":"        .unwrap_or(EnvValueKind::Text);\n    let secret_declared = kind == EnvValueKind::Secret;\n\n    if args.scope.is_some() && !secret_declared {\n        anyhow::bail!(\n            \"--scope requires the capsule manifest to declare '{}' as type=\\\"secret\\\" \\\n             (manifest declares either a non-secret env field, or no field at all for this key)\",\n            args.key\n        );\n    }\n\n    let scope = args\n        .scope\n        .map_or(EnvStorageScope::Agent, |scope| match scope {\n            ScopeArg::Agent => EnvStorageScope::Agent,\n            ScopeArg::Shared => EnvStorageScope::Shared,\n        });\n    if matches!(kind, EnvValueKind::Text) && !matches!(scope, EnvStorageScope::Agent) {\n        anyhow::bail!(\"--scope=shared is only valid for manifest-declared secrets\");\n    }\n    let mut client = crate::admin_client::connect_as_active_agent().await?;\n    let body = client\n        .request(AdminRequestKind::EnvSet {\n            principal: principal.clone(),\n            capsule: capsule.to_string(),\n            key: args.key.clone(),\n            value: args.value.clone(),\n            kind,\n            scope,\n            append: false,\n        })\n        .await?;\n    crate::admin_client::into_result(body)?;\n    println!(\n        \"{}\",\n        Theme::success(&format!(\n            \"Stored '{}' for agent '{}' (capsule {})\",","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/secret.rs#L303-L339","documentation":"`run_set` only permits `--scope=shared` for values whose kind is a manifest-declared secret. Text-typed values must stay in the default Agent scope, so any non-Agent scope on a Text value bails here. This prevents storing non-secret, machine-local text in the shared scope.","triggerScenarios":"`astrid secret set --scope shared --key FOO` where capsule_env_kind resolved FOO to EnvValueKind::Text (manifest declares it as text or has no secret declaration).","commonSituations":"Copying a working command for a secret and reusing it for a plain env var; misunderstanding that --scope=shared works for all env values; editing the manifest to change a secret to text while still passing --scope=shared.","solutions":["Remove `--scope` (defaults to Agent) if the value is a plain text env var.","Declare the key as `type = \"secret\"` in the capsule manifest if it truly must be shared.","Check the manifest env section to confirm the key's declared type before choosing a scope."],"exampleFix":"// before\nastrid secret set --agent dev --capsule web --key PORT --scope shared --value 8080\n// after\nastrid secret set --agent dev --capsule web --key PORT --value 8080","handlingStrategy":"validation","validationCode":"// only pass --scope for manifest-declared secrets\nif grep -q \"type = \\\"secret\\\"\" <(grep -A2 \"${KEY}\" capsule.toml); then\n  SCOPE=\"--scope shared\"\nelse\n  SCOPE=\"\"\nfi\nastrid secret set --key \"$KEY\" $SCOPE --value \"$VAL\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit --scope for plain text env values (Agent is the default and only valid scope).","Remember: shared storage is exclusively for manifest-declared secrets.","Check the capsule manifest's env section before constructing the command."],"tags":["cli","validation","secrets","flag-value","rust"],"backgroundTag":"invalid-flag-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}