astrid-runtime/astrid · error

invalid key: must not be empty

Error message

invalid key: must not be empty

What it means

Validation guard in run_set for secrets: the supplied env/secret key argument is an empty string. A key must be a non-empty identifier to be stored or looked up in the daemon's capsule environment; an empty key would create an unusable entry, so the command aborts before contacting the daemon.

Source

Thrown at crates/astrid-cli/src/commands/secret.rs:294

        other => anyhow::bail!("unexpected daemon metadata response: {other:?}"),
    };
    Ok(entries
        .into_iter()
        .find(|entry| entry.name == capsule.as_str())
        .and_then(|entry| {
            entry.env.get(key).map(|field| {
                if field.env_type.eq_ignore_ascii_case("secret") {
                    EnvValueKind::Secret
                } else {
                    EnvValueKind::Text
                }
            })
        }))
}

async fn run_set(args: &SetArgs) -> Result<ExitCode> {
    if args.key.is_empty() {
        anyhow::bail!("invalid key: must not be empty");
    }
    let principal = context::resolve_agent(args.agent.as_deref())?;
    let capsule = validate_optional_capsule(args.capsule.as_deref())?;

    // --scope only applies to secrets. Resolve the type from the daemon's
    // durable registry rather than reading a native principal-home manifest.
    let kind = capsule_env_kind(&capsule, &args.key)
        .await?
        .unwrap_or(EnvValueKind::Text);
    let secret_declared = kind == EnvValueKind::Secret;

    if args.scope.is_some() && !secret_declared {
        anyhow::bail!(
            "--scope requires the capsule manifest to declare '{}' as type=\"secret\" \
             (manifest declares either a non-secret env field, or no field at all for this key)",
            args.key
        );
    }

View on GitHub (pinned to affd8760f4)

Solutions

1. Pass a non-empty key: `astrid secret set --key MY_VAR ...`.
2. If using a shell variable, quote and verify it: `${KEY:?key is empty}`.
3. Add an explicit key check in the calling script before invoking the CLI.

Example fix

// before
astrid secret set --key "$KEY" --agent dev --value x
// after
: "${KEY:?KEY must be set and non-empty}"
astrid secret set --key "$KEY" --agent dev --value x

if [ -z "$KEY" ]; then echo "error: key must not be empty" >&2; exit 1; fi
astrid secret set --key "$KEY" ...

When it happens

Trigger: Running `astrid secret set --key "" ...` or invoking run_set with SetArgs.key = "" (e.g. empty variable expansion like `--key "$EMPTY_VAR"`).

Common situations: Shell variable holding the key name is unset/empty; copy-paste dropped the key name; scripted invocation builds the command from a template with a missing field.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• --scope requires the capsule manifest to declare '{key}' as
• --scope=shared is only valid for manifest-declared secrets
• durable capsule {} has malformed contracts pin
• refusing to seed canonical from a non-content-address contra
• --retain-entries must be at least 1

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/7b2fa3baa737b259. Report an issue: GitHub.