{"record":{"id":"98c2812b89370060","repo":"zeroclaw-labs/zeroclaw","slug":"environment-backed-auth-secret-inner-must-cont","errorCode":null,"errorMessage":"environment-backed auth_secret '{inner}' must contain only ASCII letters, numbers, or underscores","messagePattern":"environment-backed auth_secret '(.+?)' must contain only ASCII letters, numbers, or underscores","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/http_request.rs","lineNumber":456,"sourceCode":"    }\n    Ok(Some(value))\n}\n\nfn env_secret_reference(raw_secret: &str) -> anyhow::Result<Option<&str>> {\n    let Some(inner) = raw_secret\n        .strip_prefix(\"${\")\n        .and_then(|value| value.strip_suffix('}'))\n    else {\n        return Ok(None);\n    };\n\n    if inner.is_empty() {\n        anyhow::bail!(\n            \"environment-backed auth_secret references an empty environment variable name\"\n        );\n    }\n    if !inner.chars().all(|c| c.is_ascii_alphanumeric() || c == '_') {\n        anyhow::bail!(\n            \"environment-backed auth_secret '{inner}' must contain only ASCII letters, numbers, or underscores\"\n        );\n    }\n    Ok(Some(inner))\n}\n\n#[async_trait]\nimpl Tool for HttpRequestTool {\n    fn name(&self) -> &str {\n        \"http_request\"\n    }\n\n    fn description(&self) -> &str {\n        \"Make HTTP requests to external APIs. Supports GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS methods. \\\n        Security constraints: allowlist-only domains, local/private hosts blocked unless explicitly configured, configurable timeout and response size limits.\"\n    }\n\n    fn parameters_schema(&self) -> serde_json::Value {","sourceCodeStart":438,"sourceCodeEnd":474,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/http_request.rs#L438-L474","documentation":"Thrown by env_secret_reference (crates/zeroclaw-tools/src/http_request.rs:456) when the variable name inside a \"${...}\" secret reference contains characters other than ASCII letters, digits, and underscore. The allowed set mirrors what shell/POSIX environment variable names can safely contain, so references like \"${MY-VAR}\" or \"${my.var}\" are rejected at resolve time.","triggerScenarios":"api_token = \"${MY-VAR}\" (hyphen), \"${my.var}\" (dot), \"${VAR NAME}\" (space), or \"${VAR$}\"; environment names inherited from systems that permit hyphens (some CI platforms, docker labels) pasted into the reference; doubled braces or nested ${${X}} leaving stray characters in the inner name.","commonSituations":"CI variable names with hyphens copied into config.toml; Windows-style or label-style identifiers used as env names; typos introducing punctuation into the reference.","solutions":["Rename the environment variable to letters/digits/underscore only (e.g. MY_VAR) and reference \"${MY_VAR}\".","If the external name cannot change, export an alias: MY_VAR=\"$MY-VAR\" in the process environment.","Avoid nested or doubled brace syntax; exactly one ${...} wrapper is parsed."],"exampleFix":"# before\n[http_request.secrets]\napi_token = \"${MY-API-TOKEN}\"\n\n# after\n# rename the variable (or alias it) then:\napi_token = \"${MY_API_TOKEN}\"","handlingStrategy":"validation","validationCode":"fn env_reference_name_valid(raw: &str) -> bool {\n    match raw.strip_prefix(\"${\").and_then(|v| v.strip_suffix('}')) {\n        Some(inner) => {\n            !inner.is_empty()\n                && inner.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')\n        }\n        None => true,\n    }\n}","typeGuard":"fn is_valid_env_reference_name(inner: &str) -> bool {\n    !inner.is_empty() && inner.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')\n}","tryCatchPattern":"let result = tool.execute(args).await?;\nif let Some(err) = &result.error {\n    if err.contains(\"ASCII letters, numbers, or underscores\") {\n        // rename the referenced env var (alias hyphenated names) and retry\n    }\n}","preventionTips":["Standardize env var names on [A-Za-z0-9_] across your pipelines.","When a CI platform allows hyphens, export an underscore alias for the agent process.","Validate all ${...} references in config at startup with one shared checker."],"tags":["http","auth","secrets","environment","validation","zeroclaw"],"backgroundTag":"invalid-env-var-reference","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}