{"record":{"id":"4d16df1c4bc84ddd","repo":"astrid-runtime/astrid","slug":"scope-requires-the-capsule-manifest-to-declare","errorCode":null,"errorMessage":"--scope requires the capsule manifest to declare '{key}' as type=\"secret\" (manifest declares either a non-secret env field, or no field at all for this key)","messagePattern":"--scope requires the capsule manifest to declare '(.+?)' as type=\"secret\" \\(manifest declares either a non-secret env field, or no field at all for this key\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/secret.rs","lineNumber":307,"sourceCode":"        }))\n}\n\nasync fn run_set(args: &SetArgs) -> Result<ExitCode> {\n    if args.key.is_empty() {\n        anyhow::bail!(\"invalid key: must not be empty\");\n    }\n    let principal = context::resolve_agent(args.agent.as_deref())?;\n    let capsule = validate_optional_capsule(args.capsule.as_deref())?;\n\n    // --scope only applies to secrets. Resolve the type from the daemon's\n    // durable registry rather than reading a native principal-home manifest.\n    let kind = capsule_env_kind(&capsule, &args.key)\n        .await?\n        .unwrap_or(EnvValueKind::Text);\n    let secret_declared = kind == EnvValueKind::Secret;\n\n    if args.scope.is_some() && !secret_declared {\n        anyhow::bail!(\n            \"--scope requires the capsule manifest to declare '{}' as type=\\\"secret\\\" \\\n             (manifest declares either a non-secret env field, or no field at all for this key)\",\n            args.key\n        );\n    }\n\n    let scope = args\n        .scope\n        .map_or(EnvStorageScope::Agent, |scope| match scope {\n            ScopeArg::Agent => EnvStorageScope::Agent,\n            ScopeArg::Shared => EnvStorageScope::Shared,\n        });\n    if matches!(kind, EnvValueKind::Text) && !matches!(scope, EnvStorageScope::Agent) {\n        anyhow::bail!(\"--scope=shared is only valid for manifest-declared secrets\");\n    }\n    let mut client = crate::admin_client::connect_as_active_agent().await?;\n    let body = client\n        .request(AdminRequestKind::EnvSet {","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/secret.rs#L289-L325","documentation":"`run_set` enforces that `--scope` (agent vs shared storage) can only be used when the capsule manifest declares the key as `type=\"secret\"`. It resolves the key's kind from the daemon's capsule metadata; if the manifest declares the field as plain text, or has no field for that key at all, passing `--scope` bails with this error.","triggerScenarios":"`astrid secret set --scope agent|shared --key FOO` where the capsule's manifest either omits FOO from its env section or declares it without `type = \"secret\"`.","commonSituations":"Typo in the key name so it doesn't match the manifest entry; manifest env field declared as plain text (no type=\"secret\"); user assumes any value can be stored shared; manifest not yet reloaded by the daemon after editing.","solutions":["Add `type = \"secret\"` to the env entry for this key in the capsule manifest and redeploy/reload the capsule.","Drop the `--scope` flag if the value is genuinely a plain text env var.","Fix the key spelling so it matches the manifest entry declared as a secret.","Run the set without --scope first and check `astrid secret list` to see how the key is classified."],"exampleFix":"// before (capsule manifest)\n[env]\nAPI_KEY = { value = \"placeholder\" }\n// after\n[env]\nAPI_KEY = { value = \"placeholder\", type = \"secret\" }","handlingStrategy":"validation","validationCode":"// inspect the capsule manifest before using --scope\ngrep -A3 \"${KEY}\" capsule.toml  # entry must include type = \"secret\"","typeGuard":null,"tryCatchPattern":"// run_set pattern\nif args.scope.is_some() && !secret_declared {\n    eprintln!(\"hint: declare {key} as type=\\\"secret\\\" in the capsule manifest, or omit --scope\");\n}","preventionTips":["Declare every shareable secret with type = \"secret\" in the capsule manifest.","Double-check key spelling against the manifest env section.","Reload/redeploy the capsule after editing its manifest so the daemon registry is current.","Run `astrid secret list` first to see how the key is classified."],"tags":["cli","validation","manifest","secrets","rust"],"backgroundTag":"invalid-config-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}