{"record":{"id":"5bf628ed44e8fd36","repo":"paperclipai/paperclip","slug":"adapterenv-must-not-contain-bootstrap-token-reser","errorCode":null,"errorMessage":"adapterEnv must not contain BOOTSTRAP_TOKEN (reserved key)","messagePattern":"adapterEnv must not contain BOOTSTRAP_TOKEN \\(reserved key\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/plugins/sandbox-providers/kubernetes/src/secret-manager.ts","lineNumber":20,"sourceCode":"\nexport interface CreatePerRunSecretInput {\n  namespace: string;\n  secretName: string;\n  runId: string;\n  ownerKind: string;\n  ownerApiVersion: string;\n  ownerName: string;\n  ownerUid: string;\n  bootstrapToken: string;\n  adapterEnv: Record<string, string>;\n}\n\nexport async function createPerRunSecret(clients: KubeClients, input: CreatePerRunSecretInput): Promise<void> {\n  if (!input.ownerUid) {\n    throw new Error(\"createPerRunSecret requires a non-empty ownerUid\");\n  }\n  if (\"BOOTSTRAP_TOKEN\" in input.adapterEnv) {\n    throw new Error(\"adapterEnv must not contain BOOTSTRAP_TOKEN (reserved key)\");\n  }\n  await clients.core.createNamespacedSecret({\n    namespace: input.namespace,\n    body: {\n      apiVersion: \"v1\",\n      kind: \"Secret\",\n      type: \"Opaque\",\n      metadata: {\n        name: input.secretName,\n        namespace: input.namespace,\n        labels: {\n          \"paperclip.io/run-id\": input.runId,\n          \"paperclip.io/managed-by\": \"paperclip-k8s-plugin\",\n        },\n        ownerReferences: [\n          {\n            apiVersion: input.ownerApiVersion,\n            kind: input.ownerKind,","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/plugins/sandbox-providers/kubernetes/src/secret-manager.ts#L2-L38","documentation":"Error \"adapterEnv must not contain BOOTSTRAP_TOKEN (reserved key)\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at packages/plugins/sandbox-providers/kubernetes/src/secret-manager.ts:20 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove BOOTSTRAP_TOKEN from adapterEnv; it is reserved and set by the orchestrator."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}