{"record":{"id":"86bc26e6f24802f9","repo":"zeroclaw-labs/zeroclaw","slug":"auth-secret-cannot-be-empty","errorCode":null,"errorMessage":"auth_secret cannot be empty","messagePattern":"auth_secret cannot be empty","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/http_request.rs","lineNumber":265,"sourceCode":"        if let Some(obj) = headers.as_object() {\n            for (key, value) in obj {\n                let Some(str_val) = value.as_str() else {\n                    anyhow::bail!(\"Header '{key}' value must be a string, got: {}\", value);\n                };\n                let header_name = HeaderName::from_str(key)\n                    .map_err(|e| anyhow::Error::msg(format!(\"Invalid header name '{key}': {e}\")))?;\n                let header_value = HeaderValue::from_str(str_val).map_err(|e| {\n                    anyhow::Error::msg(format!(\"Invalid value for header '{key}': {e}\"))\n                })?;\n                result.insert(header_name, header_value);\n            }\n        }\n        Ok(result)\n    }\n\n    fn validate_secret_name(secret_name: &str) -> anyhow::Result<()> {\n        if secret_name.is_empty() {\n            anyhow::bail!(\"auth_secret cannot be empty\");\n        }\n        if secret_name.len() > 64 {\n            anyhow::bail!(\"auth_secret must be 64 characters or fewer\");\n        }\n        if !secret_name\n            .chars()\n            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')\n        {\n            anyhow::bail!(\n                \"auth_secret must contain only ASCII letters, numbers, underscores, or hyphens\"\n            );\n        }\n        Ok(())\n    }\n\n    fn resolve_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {\n        Self::validate_secret_name(secret_name)?;\n        self.reload_auth_secret(secret_name)","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/http_request.rs#L247-L283","documentation":"Thrown by HttpRequestTool::validate_secret_name (crates/zeroclaw-tools/src/http_request.rs:265) when the auth_secret argument is an empty string. auth_secret must name an entry in [http_request.secrets] of config.toml; an empty name can never match one. Passing no auth_secret at all is fine (the parameter is optional), so this error specifically means the field was present but blank.","triggerScenarios":"args = {\"url\": u, \"auth_secret\": \"\"}; templates that interpolate an optional secret name variable which resolved to empty; JSON built with a default empty string instead of omitting the key; note auth_secret: null produces a different error (\"'auth_secret' must be a string\").","commonSituations":"Optional-auth code paths that always include the key; LLM tool calls that emit an empty auth_secret when unsure; config-driven header injection where the secret name variable was never set.","solutions":["Omit the auth_secret field entirely when no Authorization header is needed.","If auth is required, pass the real key name defined under [http_request.secrets], e.g. \"api_token\".","Guard in the caller: only include auth_secret when the variable is non-empty."],"exampleFix":"// before\nlet args = json!({\"url\": u, \"auth_secret\": secret_name_var}); // var is \"\"\n\n// after\nlet mut args = json!({\"url\": u});\nif !secret_name_var.is_empty() {\n    args[\"auth_secret\"] = json!(secret_name_var);\n}","handlingStrategy":"validation","validationCode":"fn auth_secret_arg(name: Option<&str>) -> Option<&str> {\n    name.filter(|n| !n.is_empty())\n}","typeGuard":"fn is_usable_secret_name(name: &str) -> bool {\n    !name.is_empty()\n}","tryCatchPattern":"let result = tool.execute(args).await?;\nif let Some(err) = &result.error {\n    if err.contains(\"auth_secret cannot be empty\") {\n        // drop the empty field and send an unauthenticated request if acceptable\n    }\n}","preventionTips":["Omit auth_secret entirely instead of sending an empty string.","Build args conditionally: only insert auth_secret when a non-empty name is configured.","Treat null vs empty distinctly: null yields a different error (\"must be a string\")."],"tags":["http","auth","secrets","validation","zeroclaw"],"backgroundTag":"invalid-secret-name","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}