jdx/mise · error · eyre::Report

invalid bootstrap secret name '{name}': use ASCII letters, d

Error message

invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'

What it means

Secret declarations under [bootstrap.secrets] are TOML table keys, and declaration_from_toml validates each key: it must be non-empty and contain only ASCII letters, digits, '.', '_' or '-'. The key is the secret name used in prompts and references; the environment variable it maps to is validated separately (error 887).

Source

Thrown at src/system/secrets.rs:299

        None if prompt => prompt_value(declaration).map_err(|error| error.to_string())?,
        None => return Err(format!("{} ({})", declaration.name, declaration.env)),
    };
    if value.is_empty() && !declaration.allow_empty {
        return Err(format!(
            "{} ({}) must not be empty",
            declaration.name, declaration.env
        ));
    }
    Ok(value)
}

fn declaration_from_toml(name: String, declaration: SecretTomlConfig) -> Result<SecretDeclaration> {
    if name.is_empty()
        || !name
            .chars()
            .all(|character| character.is_ascii_alphanumeric() || "_.-".contains(character))
    {
        bail!("invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'");
    }
    let (env, description, allow_empty) = match declaration {
        SecretTomlConfig::Env(env) => (env, None, false),
        SecretTomlConfig::Options(options) => {
            (options.env, options.description, options.allow_empty)
        }
    };
    if !valid_env_name(&env) {
        bail!("bootstrap secret '{name}' has invalid environment variable name '{env}'");
    }
    Ok(SecretDeclaration {
        name,
        env,
        description,
        allow_empty,
    })
}

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Rename the secret key to use only ASCII letters, digits, '.', '_' or '-'
Use dots for namespacing, e.g. 'cache.token' instead of 'cache token'

Example fix

# before
[bootstrap.secrets]
"cache token" = "CACHE_TOKEN"
# after
[bootstrap.secrets]
cache.token = "CACHE_TOKEN"

Defensive patterns

Strategy: validation

Validate before calling

// Validate secret names before running bootstrap
fn valid_secret_name(name: &str) -> bool {
    !name.is_empty() && name.chars().all(|c| c.is_ascii_alphanumeric() || "_.-".contains(c))
}
assert!(secrets.keys().all(|k| valid_secret_name(k)));

Type guard

fn is_valid_secret_name(name: &str) -> bool {
    !name.is_empty() && name.chars().all(|c| c.is_ascii_alphanumeric() || "_.-".contains(c))
}

Prevention

Use dot-namespacing (cache.token) instead of spaces for multi-word secret names
Generate configs from templates that pass names through the same character whitelist

When it happens

Trigger: A TOML key like 'cache token' (space), 'café' (non-ASCII), 'key$1', or an explicitly empty quoted key under [bootstrap.secrets].

Common situations: Human-readable names with spaces pasted from docs or tickets; unicode names; template-generated configs; renaming secrets with characters the validator rejects.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/f0f1418df04b60f2. Report an issue: GitHub.