warpdotdev/warp · error

invalid value 'secret'

Error message

invalid value 'secret'

What it means

Thrown by the dispatcher arm for CliCommand::Secret (mod.rs:190) when `secret` parsed but FeatureFlag::WarpManagedSecrets is disabled. The deliberately clap-shaped 'invalid value' error hides the managed-secrets subsystem (create/list of server-resolved credentials) when the feature flag is off. Flag defaults to false and is channel/account-dependent.

Source

Thrown at app/src/ai/agent_sdk/mod.rs:190

        CliCommand::Integration(integration_cmd) => {
            if !FeatureFlag::IntegrationCommand.is_enabled() {
                return Err(anyhow::anyhow!("invalid value 'integration'"));
            }
            integration::run(ctx, global_options, integration_cmd)
        }
        #[cfg(target_family = "wasm")]
        CliCommand::Integration(_) => {
            return Err(anyhow::anyhow!("invalid value 'integration'"));
        }
        CliCommand::Schedule(schedule_cmd) => {
            if !FeatureFlag::ScheduledAmbientAgents.is_enabled() {
                return Err(anyhow::anyhow!("invalid value 'schedule'"));
            }
            schedule::run(ctx, global_options, schedule_cmd)
        }
        CliCommand::Secret(secret_cmd) => {
            if !FeatureFlag::WarpManagedSecrets.is_enabled() {
                return Err(anyhow::anyhow!("invalid value 'secret'"));
            }
            secret::run(ctx, global_options, secret_cmd)
        }
        CliCommand::Federate(federate_cmd) => {
            if !FeatureFlag::OzIdentityFederation.is_enabled() {
                return Err(anyhow::anyhow!("invalid value 'federate'"));
            }
            federate::run(ctx, global_options, federate_cmd)
        }
        CliCommand::HarnessSupport(args) => {
            if !FeatureFlag::AgentHarness.is_enabled() {
                return Err(anyhow::anyhow!("invalid value 'harness-support'"));
            }
            harness_support::run(ctx, global_options, args)
        }
        CliCommand::Artifact(artifact_cmd) => {
            if !FeatureFlag::ArtifactCommand.is_enabled() {
                return Err(anyhow::anyhow!("invalid value 'artifact'"));

View on GitHub (pinned to e72fd7aacb)

Solutions

1. Run from a build/account with WarpManagedSecrets enabled, or update to a version where it shipped to your channel
2. If you hit this while setting up --claude-auth-secret/--codex-auth-secret, create the secret from an environment where the flag is on; the name is server-side and reusable
3. As a Warp developer, override the flag or add FeatureFlag::WarpManagedSecrets to DOGFOOD_FLAGS and rebuild

Example fix

# before
$ oz secret create claude api-key my-key
Error: invalid value 'secret'

# after: only call when available
if FeatureFlag::WarpManagedSecrets.is_enabled() {
    secret::run(ctx, global_options, cmd)?;
}

if matches!(cmd, CliCommand::Secret(_))
    && !FeatureFlag::WarpManagedSecrets.is_enabled()
{
    anyhow::bail!("managed secrets unavailable; provision credentials another way");
}

pub fn managed_secrets_available() -> bool {
    FeatureFlag::WarpManagedSecrets.is_enabled()
}

match agent_sdk::run(ctx, opts, cmd) {
    Err(e) if e.to_string() == "invalid value 'secret'" => {
        // create the secret from an environment where the flag is on
    }
    result => result?,
}

When it happens

Trigger: Invoking `<cli> secret ...` (e.g. `oz secret create claude api-key NAME`) where FeatureFlag::WarpManagedSecrets.is_enabled() == false. Subcommand and subargs parse fine; the error comes from the flag gate inside the handler.

Common situations: Following harness setup docs that say `oz secret create ...` on a build where managed secrets are gated; scripts provisioning credentials before a run-cloud launch; release-channel builds where the feature is not yet enabled.

Related errors

• invalid value 'integration'
• invalid value 'schedule'
• invalid value 'harness-support'
• invalid value 'artifact'
• invalid value 'api-key'

AI-assisted analysis of warpdotdev/warp@e72fd7aacb (2026-08-16). Data as JSON: /api/errors/191ac780cf7733ba. Report an issue: GitHub.