{"record":{"id":"7b2fa3baa737b259","repo":"astrid-runtime/astrid","slug":"invalid-key-must-not-be-empty","errorCode":null,"errorMessage":"invalid key: must not be empty","messagePattern":"invalid key: must not be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/secret.rs","lineNumber":294,"sourceCode":"        other => anyhow::bail!(\"unexpected daemon metadata response: {other:?}\"),\n    };\n    Ok(entries\n        .into_iter()\n        .find(|entry| entry.name == capsule.as_str())\n        .and_then(|entry| {\n            entry.env.get(key).map(|field| {\n                if field.env_type.eq_ignore_ascii_case(\"secret\") {\n                    EnvValueKind::Secret\n                } else {\n                    EnvValueKind::Text\n                }\n            })\n        }))\n}\n\nasync fn run_set(args: &SetArgs) -> Result<ExitCode> {\n    if args.key.is_empty() {\n        anyhow::bail!(\"invalid key: must not be empty\");\n    }\n    let principal = context::resolve_agent(args.agent.as_deref())?;\n    let capsule = validate_optional_capsule(args.capsule.as_deref())?;\n\n    // --scope only applies to secrets. Resolve the type from the daemon's\n    // durable registry rather than reading a native principal-home manifest.\n    let kind = capsule_env_kind(&capsule, &args.key)\n        .await?\n        .unwrap_or(EnvValueKind::Text);\n    let secret_declared = kind == EnvValueKind::Secret;\n\n    if args.scope.is_some() && !secret_declared {\n        anyhow::bail!(\n            \"--scope requires the capsule manifest to declare '{}' as type=\\\"secret\\\" \\\n             (manifest declares either a non-secret env field, or no field at all for this key)\",\n            args.key\n        );\n    }","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/secret.rs#L276-L312","documentation":"Validation guard in run_set for secrets: the supplied env/secret key argument is an empty string. A key must be a non-empty identifier to be stored or looked up in the daemon's capsule environment; an empty key would create an unusable entry, so the command aborts before contacting the daemon.","triggerScenarios":"Running `astrid secret set --key \"\" ...` or invoking run_set with SetArgs.key = \"\" (e.g. empty variable expansion like `--key \"$EMPTY_VAR\"`).","commonSituations":"Shell variable holding the key name is unset/empty; copy-paste dropped the key name; scripted invocation builds the command from a template with a missing field.","solutions":["Pass a non-empty key: `astrid secret set --key MY_VAR ...`.","If using a shell variable, quote and verify it: `${KEY:?key is empty}`.","Add an explicit key check in the calling script before invoking the CLI."],"exampleFix":"// before\nastrid secret set --key \"$KEY\" --agent dev --value x\n// after\n: \"${KEY:?KEY must be set and non-empty}\"\nastrid secret set --key \"$KEY\" --agent dev --value x","handlingStrategy":"validation","validationCode":"if [ -z \"$KEY\" ]; then echo \"error: key must not be empty\" >&2; exit 1; fi\nastrid secret set --key \"$KEY\" ...","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Quote shell variables and use ${VAR:?msg} to catch empty values.","Avoid building CLI args from unset environment variables in scripts.","Validate required arguments at the top of wrapper scripts."],"tags":["cli","validation","empty-argument","rust"],"backgroundTag":"empty-required-field","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}