{"record":{"id":"b6cb02d00995de7a","repo":"astrid-runtime/astrid","slug":"capsule-is-required-native-default-env-storage","errorCode":null,"errorMessage":"--capsule is required; native default env storage was retired","messagePattern":"--capsule is required; native default env storage was retired","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/secret.rs","lineNumber":256,"sourceCode":"    /// Capsule the secret belongs to.\n    #[arg(long, value_name = \"NAME\")]\n    pub capsule: Option<String>,\n}\n\n/// Top-level dispatcher for `astrid secret`.\npub(crate) async fn run(cmd: SecretCommand) -> Result<ExitCode> {\n    match cmd {\n        SecretCommand::Set(args) => run_set(&args).await,\n        SecretCommand::List(args) => run_list(&args).await,\n        SecretCommand::Delete(args) => run_delete(&args).await,\n    }\n}\n\nfn validate_optional_capsule(capsule: Option<&str>) -> Result<CapsuleId> {\n    CapsuleId::new(\n        capsule\n            .ok_or_else(|| {\n                anyhow::anyhow!(\"--capsule is required; native default env storage was retired\")\n            })?\n            .to_owned(),\n    )\n    .context(\"invalid capsule name\")\n}\n\n/// Resolve one capsule's non-secret schema through the authenticated daemon\n/// inventory. The CLI must not inspect a materialized `Capsule.toml` under a\n/// principal home: the registry snapshot is the authority for installed\n/// capsule metadata, while workspace capsules are only visible through the\n/// explicit workspace inventory.\nasync fn capsule_env_kind(capsule: &CapsuleId, key: &str) -> Result<Option<EnvValueKind>> {\n    let mut client = crate::socket_client::connect_kernel_for_workspace(None).await?;\n    let response = client.request(KernelRequest::GetCapsuleMetadata).await?;\n    let entries = match response {\n        astrid_core::kernel_api::KernelResponse::CapsuleMetadata(entries) => entries,\n        astrid_core::kernel_api::KernelResponse::Error(error) => {\n            anyhow::bail!(\"daemon metadata lookup failed: {error}\");","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/secret.rs#L238-L274","documentation":"run_set and run_delete require an explicit --capsule name because the CLI's built-in native default environment secret storage was removed. validate_optional_capsule refuses to proceed when no capsule argument is supplied, and then validates the name via CapsuleId::new. It exists to force migration off the retired default store rather than silently falling back to it.","triggerScenarios":"Calling `astrid secret set` or `astrid secret delete` without passing --capsule (capsule is None). Also triggered when the value passed to --capsule fails CapsuleId::new validation, though that produces the wrapped 'invalid capsule name' context.","commonSituations":"Scripts or muscle-memory invocations written before the native default env storage was retired; CI pipelines that relied on an implicit default environment; docs or READMEs still showing the old flagless usage.","solutions":["Re-run the command passing --capsule <name> with the target capsule.","List existing capsules to find the correct name, then retry with it.","If the secret lived in the retired native default env storage, migrate it into a named capsule first.","Update scripts/CI to always pass --capsule."],"exampleFix":"// before\nastrid secret set API_KEY=...\n// after\nastrid secret set API_KEY=... --capsule prod","handlingStrategy":"validation","validationCode":"// shell check before invoking\nif [ -z \"$CAPSULE\" ]; then echo \"--capsule is required\" >&2; exit 2; fi\n// rust: if building args programmatically\nassert!(!capsule.is_empty(), \"--capsule is required\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass --capsule explicitly in scripts and docs.","Export the capsule name in CI as a required variable.","Migrate any secrets from the retired native default storage to named capsules.","Pin a wrapper script that injects the default capsule name for interactive use."],"tags":["cli","missing-argument","secrets","migration"],"backgroundTag":"missing-required-flag","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}