{"record":{"id":"af9c0b2c2a258227","repo":"JuliusBrussee/caveman","slug":"name-must-not-contain-a-newline","errorCode":null,"errorMessage":"${name} must not contain a newline","messagePattern":"(.+?) must not contain a newline","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cli/src/index.ts","lineNumber":9247,"sourceCode":"// auth header, then append exactly one current value when one is supplied.\nfunction mergeAnthropicCustomHeader(raw: string | undefined, name: string, value: string | undefined): string {\n  const target = name.toLowerCase();\n  const kept = (raw ?? \"\")\n    .split(/\\r\\n|\\n|\\r/)\n    .filter((line) => {\n      if (!line.trim()) return false;\n      const colon = line.indexOf(\":\");\n      const headerName = (colon < 0 ? line : line.slice(0, colon)).trim().toLowerCase();\n      return headerName !== target;\n    });\n  if (value !== undefined) kept.push(`${name}: ${value}`);\n  return kept.join(\"\\n\");\n}\n\nfunction bedrockCredentialEnvValue(env: NodeJS.ProcessEnv, name: string): string | undefined {\n  const raw = env[name];\n  if (typeof raw !== \"string\" || !raw.trim()) return undefined;\n  if (/[\\r\\n]/.test(raw)) throw new Error(`${name} must not contain a newline`);\n  return raw.trim();\n}\n\nfunction bedrockUpstreamCredentialFromEnv(env: NodeJS.ProcessEnv): string | undefined {\n  const bearer = bedrockCredentialEnvValue(env, \"AWS_BEARER_TOKEN_BEDROCK\");\n  if (bearer) return bearer;\n  const accessKey = bedrockCredentialEnvValue(env, \"AWS_ACCESS_KEY_ID\");\n  const secretKey = bedrockCredentialEnvValue(env, \"AWS_SECRET_ACCESS_KEY\");\n  const sessionToken = bedrockCredentialEnvValue(env, \"AWS_SESSION_TOKEN\");\n  if (!accessKey && !secretKey && !sessionToken) return undefined;\n  if (!accessKey || !secretKey) {\n    throw new Error(\"AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY must be set together\");\n  }\n  return [accessKey, secretKey, ...(sessionToken ? [sessionToken] : [])].join(\":\");\n}\n\n// applyClaudeBedrockWrap selects Claude Code's native Bedrock or opt-in Mantle\n// transport only when the operator explicitly requests it. The default Claude","sourceCodeStart":9229,"sourceCodeEnd":9265,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/packages/cli/src/index.ts#L9229-L9265","documentation":"bedrockCredentialEnvValue reads a Bedrock credential environment variable and rejects it if it contains a carriage return or newline. Newlines in credentials would corrupt the colon-joined credential string and downstream header/auth handling, so the wrapper fails fast with the variable name in the message.","triggerScenarios":"AWS_BEARER_TOKEN_BEDROCK, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, or AWS_SESSION_TOKEN is set in the environment with a trailing/embedded newline or \\r (e.g. from copy-paste, `export VAR=$(cat file)` on a file without -w, or a shell profile that wraps values).","commonSituations":"Pasting a bearer token from an editor that adds a newline; loading env from .env files with quoted multi-line values; CI secret managers that append newlines; Windows CRLF leaked into values.","solutions":["Re-export the variable on a single line without surrounding whitespace: export AWS_BEARER_TOKEN_BEDROCK=\"<token>\".","Strip newlines when loading from a file: export AWS_BEARER_TOKEN_BEDROCK=\"$(tr -d '\\r\\n' < token.txt)\".","Check your .env / shell rc files for embedded line breaks or CRLF endings and fix them.","Verify with: printf '%s' \"$AWS_BEARER_TOKEN_BEDROCK\" | od -c | grep -E '\\\\r|\\\\n'."],"exampleFix":"// before\nexport AWS_BEARER_TOKEN_BEDROCK=\"$(cat ~/bedrock-token.txt)\"\n// after\nexport AWS_BEARER_TOKEN_BEDROCK=\"$(tr -d '\\r\\n' < ~/bedrock-token.txt)\"","handlingStrategy":"validation","validationCode":"for (const name of [\"AWS_BEARER_TOKEN_BEDROCK\", \"AWS_ACCESS_KEY_ID\", \"AWS_SECRET_ACCESS_KEY\", \"AWS_SESSION_TOKEN\"]) {\n  const v = process.env[name];\n  if (typeof v === \"string\" && /[\\r\\n]/.test(v)) throw new Error(`${name} contains a newline; re-export it on one line`);\n}","typeGuard":"function isSingleLineCredential(v: unknown): v is string {\n  return typeof v === \"string\" && v.trim().length > 0 && !/[\\r\\n]/.test(v);\n}","tryCatchPattern":"try {\n  applyBedrockWrap(env, agent);\n} catch (e) {\n  if (String((e as Error).message).endsWith(\"must not contain a newline\")) {\n    // sanitize: env[name] = env[name].replace(/[\\r\\n]+/g, \"\") then retry once\n  }\n}","preventionTips":["Use tr -d '\\r\\n' or xargs when exporting credentials from files.","Keep .env files LF-only and single-line values, quoted.","Check CI secret managers for automatic trailing newlines.","Sanitize credential values at load time in wrapper scripts."],"tags":["env","aws","bedrock","credentials"],"backgroundTag":"invalid-env-var-value","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}