{"record":{"id":"dea3eedeb63b40d5","repo":"paperclipai/paperclip","slug":"secret-value-is-required-pass-value-or-value","errorCode":null,"errorMessage":"Secret value is required. Pass --value or --value-env.","messagePattern":"Secret value is required\\. Pass --value or --value-env\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/src/commands/client/secrets.ts","lineNumber":204,"sourceCode":"  return next;\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> | null {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return null;\n  return value as Record<string, unknown>;\n}\n\nfunction readValueFromOptions(opts: { value?: string; valueEnv?: string }): string {\n  if (opts.value !== undefined && opts.valueEnv !== undefined) {\n    throw new Error(\"Use only one of --value or --value-env.\");\n  }\n  if (opts.valueEnv !== undefined) {\n    const value = process.env[opts.valueEnv];\n    if (!value) throw new Error(`Environment variable ${opts.valueEnv} is empty or unset.`);\n    return value;\n  }\n  if (opts.value !== undefined) return opts.value;\n  throw new Error(\"Secret value is required. Pass --value or --value-env.\");\n}\n\nfunction renderDeclaration(input: CompanyPortabilityEnvInput): Record<string, unknown> {\n  const scope = input.agentSlug\n    ? `agent:${input.agentSlug}`\n    : input.projectSlug\n      ? `project:${input.projectSlug}`\n      : \"company\";\n  return {\n    key: input.key,\n    scope,\n    kind: input.kind,\n    requirement: input.requirement,\n    portability: input.portability,\n    hasDefault: input.defaultValue !== null && input.defaultValue.length > 0,\n    description: input.description,\n  };\n}","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/paperclipai/paperclip/blob/67001ec6eb96ae601aa27bc91d9b2415d665334a/cli/src/commands/client/secrets.ts#L186-L222","documentation":"`readValueFromOptions` falls through both the `--value-env` and `--value` branches because neither option was provided (both `undefined`). It throws requiring at least one value source. This is the required-input guard for secret set/create commands.","triggerScenarios":"Invoking a secret value command with neither `--value` nor `--value-env`, e.g. `secrets set <key>` with no value source.","commonSituations":"Assuming the command will prompt interactively (it does not); forgetting the value flag; a script that conditionally added the flag but the condition was false.","solutions":["Pass a literal: `--value <secret>`","Or read from the environment: `--value-env <NAME>` (after exporting it)","In scripts, fail fast when no value source is configured before invoking the command"],"exampleFix":"# before\npaperclipai secrets set comp-1 DB_PASSWORD\n# after\npaperclipai secrets set comp-1 DB_PASSWORD --value-env DB_PASSWORD","handlingStrategy":"validation","validationCode":"function requireValueSource(opts: { value?: string; valueEnv?: string }): void {\n  if (opts.value === undefined && opts.valueEnv === undefined) {\n    throw new Error(\"Secret value is required. Pass --value or --value-env.\");\n  }\n}\nrequireValueSource(opts);","typeGuard":"function hasValueSource(opts: { value?: string; valueEnv?: string }): opts is { value: string } | { valueEnv: string } {\n  return opts.value !== undefined || opts.valueEnv !== undefined;\n}","tryCatchPattern":null,"preventionTips":["Always pass one of --value or --value-env for secret set/create","Fail fast in scripts when no value source is configured","Do not expect an interactive prompt"],"tags":["cli","secrets","validation","required-input"],"backgroundTag":null,"analyzedSha":"67001ec6eb96ae601aa27bc91d9b2415d665334a","analyzedAt":"2026-08-12T12:05:45.408Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}