{"record":{"id":"c8cfba95a17bf200","repo":"vercel/ai","slug":"acp-runtime-environment-value-for-key-contains","errorCode":null,"errorMessage":"ACP runtime environment value for ${key} contains NUL.","messagePattern":"ACP runtime environment value for (.+?) contains NUL\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/harness-acp/src/v1/implementation.ts","lineNumber":345,"sourceCode":"    throw new Error(\n      `ACP npm package version must be an exact semantic version; received ${JSON.stringify(source.packageVersion)}.`,\n    );\n  }\n}\n\nfunction validateEnvironment({\n  env,\n}: {\n  env: Readonly<Record<string, string>> | undefined;\n}): void {\n  for (const [key, value] of Object.entries(env ?? {})) {\n    if (!ENVIRONMENT_VARIABLE_NAME_REGEXP.test(key)) {\n      throw new Error(\n        `ACP environment variable name is invalid: ${JSON.stringify(key)}.`,\n      );\n    }\n    if (value.includes('\\0')) {\n      throw new Error(`ACP runtime environment value for ${key} contains NUL.`);\n    }\n  }\n}\n\nfunction validateForwardEnvironment({\n  forwardEnv,\n}: {\n  forwardEnv: ReadonlyArray<string> | undefined;\n}): void {\n  for (const name of forwardEnv ?? []) {\n    if (!ENVIRONMENT_VARIABLE_NAME_REGEXP.test(name)) {\n      throw new Error(\n        `ACP environment variable name is invalid: ${JSON.stringify(name)}.`,\n      );\n    }\n  }\n}\n","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/harness-acp/src/v1/implementation.ts#L327-L363","documentation":"Environment variable values in implementation.env must not contain NUL bytes ('\\0'), since POSIX process environments are NUL-delimited and such a value would corrupt or truncate the spawned subprocess's environment. The check runs per-entry inside validateEnvironment after the name check.","triggerScenarios":"createACPV1 where any env value contains '\\0' — typically from binary data decoded into a string, buffer slicing mistakes, or config parsers that leave embedded NULs in YAML/JSON strings.","commonSituations":"Reading a secret from a binary file, concatenating Buffer content without toString, or receiving input from an untrusted source that embeds NUL terminators.","solutions":["Strip or reject NUL characters in the value before configuring: value.replace(/\\0/g, '').","Fix the producer of the value to decode Buffers as UTF-8 (buf.toString('utf8')) instead of implicit byte-to-string conversion.","Validate/sanitize all externally sourced env values before passing them to createACPV1."],"exampleFix":"// before\ncreateACPV1({ env: { TOKEN: rawBufferValue.toString() } }); // may contain \\0\n// after\ncreateACPV1({ env: { TOKEN: rawBufferValue.toString('utf8').replace(/\\0/g, '') } });","handlingStrategy":"validation","validationCode":"for (const [key, value] of Object.entries(env ?? {})) {\n  if (value.includes('\\0')) {\n    throw new Error(`NUL byte in env value for ${key}`);\n  }\n}","typeGuard":"function isNulFreeEnvValue(value) {\n  return typeof value === 'string' && !value.includes('\\0');\n}","tryCatchPattern":"try {\n  const impl = createACPV1(settings);\n} catch (err) {\n  if (err instanceof Error && err.message.includes('contains NUL')) {\n    console.error('Sanitize the env value: strip NUL bytes and fix its decoding');\n  }\n  throw err;\n}","preventionTips":["Always decode Buffers with an explicit encoding (toString('utf8')) before using as env values","Sanitize externally sourced values with replace(/\\0/g, '')","Never put binary data into environment variables; pass it via files or stdin instead"],"tags":["configuration","environment","validation","encoding"],"backgroundTag":"invalid-config-value","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}