astrid-runtime/astrid · error

--var has an invalid key (got {key:?})

Error message

--var has an invalid key (got {key:?})

What it means

validate_values parses each --var item with split_once('='). After splitting, a key that is empty, contains a NUL byte, or contains a ':' is rejected. Keys must be non-empty, NUL-free, and colon-free to be valid env identifiers.

Source

Thrown at crates/astrid-cli/src/commands/capsule/install_daemon.rs:417

    }
    if path.is_file() {
        return astrid_capsule_install::read_archive_manifest(path)
            .with_context(|| format!("read Capsule.toml from {}", path.display()));
    }
    bail!("source path does not exist: {source}")
}

fn validate_values(
    manifest: &CapsuleManifest,
    items: &[String],
) -> anyhow::Result<Vec<DaemonEnvValue>> {
    let mut parsed = HashMap::new();
    for item in items {
        let (key, value) = item
            .split_once('=')
            .ok_or_else(|| anyhow::anyhow!("--var must be KEY=VALUE (got {item:?})"))?;
        if key.is_empty() || key.contains('\0') || key.contains(':') {
            bail!("--var has an invalid key (got {key:?})");
        }
        if parsed.insert(key.to_owned(), value.to_owned()).is_some() {
            bail!("--var '{key}' was supplied more than once");
        }
    }

    let mut values = Vec::with_capacity(parsed.len());
    for (key, value) in parsed {
        let definition = manifest.env.get(&key).ok_or_else(|| {
            anyhow::anyhow!(
                "--var names no [env] field in {}: {key}",
                manifest.package.name
            )
        })?;
        let kind = if definition.env_type.eq_ignore_ascii_case("secret") {
            if value.len() > 64 * 1024 {
                bail!("secret value for {key} exceeds 65536-byte limit");
            }

View on GitHub (pinned to affd8760f4)

Solutions

  1. Rewrite the --var argument as plain KEY=VALUE with no colon or NUL in KEY.
  2. Quote the argument in your shell so spaces don't split it: --var 'KEY=value'.
  3. Check the [env] key spelling in Capsule.toml and use that exact key.

Example fix

// before
--var 'service:port=8080'
// after
--var 'service_port=8080'
Defensive patterns

Strategy: validation

Validate before calling

const KEY_RE: &str = "^[^:=\0][^:\0]*$"; // key must be non-empty, no ':' or NUL
assert!(key_chars.all(|c| c != ':' && c != '\0'), "invalid --var key");

Type guard

fn valid_key(k: &str) -> bool { !k.is_empty() && !k.contains(':') && !k.contains('\0') }

Try / catch

on this error, print the offending --var item and exit; fix the key format, don't retry blindly.

Prevention

When it happens

Trigger: Passing --var like `--var =value`, `--var bad:key=v`, or a key containing a NUL character to install_local_via_daemon_for_target_with_generation (or the tests vars_are_typed_and_manifest_bound / non_empty_values_do_not_attempt_resume_skip).

Common situations: Copy-pasting `KEY: value` style config into --var; extra whitespace producing an empty key; scripting that mangles the KEY=VALUE form.

Understand the failure class

Background: "Unknown argument", "Invalid value", and "must be one of": invalid CLI argument errors explained — this error's family across 35 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/a9d4cf945413044a. Report an issue: GitHub.