{"record":{"id":"b44d9bfcc391bcd8","repo":"Hmbown/CodeWhale","slug":"agent-profile-model-must-be-a-visible-model-id","errorCode":null,"errorMessage":"agent profile {} model must be a visible model id without whitespace or secrets","messagePattern":"agent profile (.+?) model must be a visible model id without whitespace or secrets","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/fleet/profile.rs","lineNumber":541,"sourceCode":"    let trimmed = value.trim();\n    if trimmed.is_empty() {\n        bail!(\"agent profile {} {field} cannot be empty\", path.display());\n    }\n    if trimmed != value || !trimmed.chars().all(is_agent_profile_token_char) {\n        bail!(\n            \"agent profile {} {field} must be a simple token\",\n            path.display()\n        );\n    }\n    Ok(())\n}\n\nfn validate_agent_profile_model_hint(path: &Path, value: Option<&str>) -> Result<()> {\n    let Some(value) = value else {\n        return Ok(());\n    };\n    if !is_model_hint(value) {\n        bail!(\n            \"agent profile {} model must be a visible model id without whitespace or secrets\",\n            path.display()\n        );\n    }\n    Ok(())\n}\n\n/// Validate an explicit `provider` field as a safe provider id (#4093).\n///\n/// Built-in providers are accepted by the runtime vocabulary, and user-named\n/// OpenAI-compatible custom providers are accepted as simple tokens so the\n/// launch path can resolve `[providers.<id>]` from the session config (#3965).\n/// This field remains the ONLY place a profile's provider is established:\n/// callers never infer it from `model` (EPIC #2608).\nfn validate_agent_profile_provider(path: &Path, value: &str) -> Result<()> {\n    let trimmed = value.trim();\n    if trimmed.is_empty() {\n        bail!(\"agent profile {} provider cannot be empty\", path.display());","sourceCodeStart":523,"sourceCodeEnd":559,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/fleet/profile.rs#L523-L559","documentation":"The optional `model` hint in an agent profile must pass is_model_hint: a plain visible model id without whitespace or anything that looks like a secret. Arbitrary strings (paths, bearer tokens, model names with spaces) are rejected to avoid leaking secrets through profile files.","triggerScenarios":"An agent profile TOML with model = \"claude sonnet 4\" (spaces), model = \"sk-...\" or a URL-ish/credential-like string, or any value failing is_model_hint, loaded via agent_profile_from_toml.","commonSituations":"Writing a human-friendly model name with spaces instead of the provider's model id; pasting an API key or endpoint URL into the model field by mistake; copy-pasting a full provider-qualified string with whitespace.","solutions":["Replace the model value with the exact visible model id (no spaces), e.g. \"claude-sonnet-4\"","Remove any credential-looking content from the model field — keys belong in provider config/env, never in the profile","Delete the model line if the profile should inherit the workspace default model"],"exampleFix":"// before\nmodel = \"claude sonnet 4\"\n\n// after\nmodel = \"claude-sonnet-4\"","handlingStrategy":"validation","validationCode":"fn looks_like_model_hint(s: &str) -> bool {\n    !s.is_empty() && !s.contains(char::is_whitespace) && !s.contains(\"sk-\") && !s.contains(\"key\")\n}\nif let Some(m) = &profile.model {\n    if !looks_like_model_hint(m) { eprintln!(\"model must be a plain visible model id\"); }\n}","typeGuard":null,"tryCatchPattern":"match result {\n    Err(e) if e.to_string().contains(\"visible model id\") => {\n        eprintln!(\"set model to the exact provider model id without spaces or secrets\");\n    }\n    other => other?,\n}","preventionTips":["Use exact provider model ids (no spaces) in the model field","Never paste API keys or URLs into the model field — credentials live in provider config/env","Omit the model field to inherit the workspace default"],"tags":["fleet","agent-profiles","validation","model-id"],"backgroundTag":"invalid-config-value","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}