{"record":{"id":"a2877d88bd0e6420","repo":"paperclipai/paperclip","slug":"environment-variable-envname-is-empty-or-not-se","errorCode":null,"errorMessage":"Environment variable ${envName} is empty or not set.","messagePattern":"Environment variable (.+?) is empty or not set\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/src/commands/client/auth.ts","lineNumber":200,"sourceCode":"            handleCommandError(err);\n          }\n        }),\n    );\n  }\n}\n\nfunction parseJson(value: string): unknown {\n  return JSON.parse(value) as unknown;\n}\n\nfunction resolveChallengeToken(opts: AuthChallengeOptions): string {\n  const token = opts.token?.trim();\n  if (token) return token;\n  const envName = opts.tokenEnv?.trim();\n  if (envName) {\n    const envValue = process.env[envName]?.trim();\n    if (envValue) return envValue;\n    throw new Error(`Environment variable ${envName} is empty or not set.`);\n  }\n  throw new Error(\"Challenge secret is required. Pass --token or --token-env.\");\n}\n","sourceCodeStart":182,"sourceCodeEnd":204,"githubUrl":"https://github.com/paperclipai/paperclip/blob/67001ec6eb96ae601aa27bc91d9b2415d665334a/cli/src/commands/client/auth.ts#L182-L204","documentation":"Thrown by resolveChallengeToken() in auth.ts when --token-env names an environment variable that is either unset or empty/whitespace. The CLI deliberately reads from the named env var only when --token is absent, and treats an empty/unset env var as a hard failure rather than silently continuing without a secret.","triggerScenarios":"Running `paperclipai auth challenge ... --token-env MY_VAR` where MY_VAR is not exported in the shell or is exported as the empty string. Typo in the variable name. CI job that forgot to `export` the secret.","commonSituations":"Secret manager did not inject the env var. Variable name typo. Shell scoping issue (set in a subshell, not visible to the CLI). CI masked-secret that resolves to empty.","solutions":["Export the variable in the same shell: `export MY_VAR=...; paperclipai auth challenge --token-env MY_VAR`.","Check the name: `printenv MY_VAR` should print a non-empty value.","Pass the value directly with --token if env wiring is unreliable.","In CI, ensure the secret is mapped to the env var in the runner config."],"exampleFix":"// before\npaperclipai auth challenge --token-env CHALL_TOKEN   # CHALL_TOKEN unset\n// after\nexport CHALL_TOKEN=secret123\npaperclipai auth challenge --token-env CHALL_TOKEN","handlingStrategy":"validation","validationCode":"function resolveChallengeToken(opts: { token?: string; tokenEnv?: string }): string {\n  const t = opts.token?.trim();\n  if (t) return t;\n  const envName = opts.tokenEnv?.trim();\n  if (!envName) throw new Error('Pass --token or --token-env');\n  const v = process.env[envName];\n  if (typeof v !== 'string' || v.trim() === '') {\n    throw new Error(`Env var ${envName} is unset/empty. Export it: export ${envName}=<secret>`);\n  }\n  return v.trim();\n}","typeGuard":null,"tryCatchPattern":"try { resolveChallengeToken(opts); }\ncatch (err) {\n  const msg = err instanceof Error ? err.message : '';\n  if (msg.endsWith('is empty or not set.')) {\n    console.error(`Export the named env var, or pass --token directly.`);\n    process.exit(2);\n  }\n  throw err;\n}","preventionTips":["Prefer --token in CI to avoid env-wiring surprises; use --token-env only when secret managers inject reliably.","Validate with `printenv <NAME>` before running the command.","Beware shell scoping: export in the same shell, not a subshell.","Treat an empty secret as a hard failure, not a default."],"tags":["cli","auth","env","secrets","validation"],"backgroundTag":null,"analyzedSha":"67001ec6eb96ae601aa27bc91d9b2415d665334a","analyzedAt":"2026-08-12T12:05:45.408Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}