zeroclaw-labs/zeroclaw · error · anyhow::Error

auth_secret requires a config.toml path

Error message

auth_secret requires a config.toml path

What it means

Thrown by HttpRequestTool::reload_auth_secret (crates/zeroclaw-tools/src/http_request.rs:291) when the tool was built with a config path that is Some but empty. auth_secret values are resolved by re-reading config.toml at request time (so secret rotations do not need a restart), which is impossible without a real path. A distinct sibling error ("auth_secret requires runtime config reload support") fires when the path is None, i.e. the tool was built with HttpRequestTool::new instead of new_with_config.

Source

Thrown at crates/zeroclaw-tools/src/http_request.rs:291

        {
            anyhow::bail!(
                "auth_secret must contain only ASCII letters, numbers, underscores, or hyphens"
            );
        }
        Ok(())
    }

    fn resolve_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {
        Self::validate_secret_name(secret_name)?;
        self.reload_auth_secret(secret_name)
    }

    fn reload_auth_secret(&self, secret_name: &str) -> anyhow::Result<String> {
        let config_path = self.config_path.as_ref().ok_or_else(|| {
            anyhow::Error::msg("auth_secret requires runtime config reload support")
        })?;
        if config_path.as_os_str().is_empty() {
            anyhow::bail!("auth_secret requires a config.toml path");
        }

        let contents = std::fs::read_to_string(config_path).map_err(|e| {
            anyhow::Error::msg(format!(
                "Failed to read config file {} for auth_secret '{secret_name}': {e}",
                config_path.display()
            ))
        })?;
        let config: zeroclaw_config::schema::Config = toml::from_str(&contents).map_err(|e| {
            anyhow::Error::msg(format!(
                "Failed to parse config file {} for auth_secret '{secret_name}': {e}",
                config_path.display()
            ))
        })?;

        let raw_secret = config
            .http_request
            .secrets

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Build the tool with HttpRequestTool::new_with_config and the absolute path of the live config.toml.
2. If you run the standard runtime, make sure the runtime's config discovery (config path env/flag) resolves to a non-empty path.
3. If you never use auth_secret, you can ignore this; literal Authorization headers work without a config path.

Example fix

// before
let tool = HttpRequestTool::new_with_config(sec, domains, 1_000_000, 30, false, vec![], vec![], PathBuf::from(""), false);

// after
let tool = HttpRequestTool::new_with_config(sec, domains, 1_000_000, 30, false, vec![], vec![], config_dir.join("config.toml"), secrets_encrypt);

fn auth_secret_support_available(config_path: &Option<std::path::PathBuf>) -> bool {
    config_path.as_ref().is_some_and(|p| !p.as_os_str().is_empty())
}
// check before enabling UI/flows that use auth_secret

let result = tool.execute(args).await?;
if let Some(err) = &result.error {
    if err.contains("requires a config.toml path") || err.contains("runtime config reload support") {
        // host misconfiguration: rebuild tool with the real config path; do not retry
    }
}

When it happens

Trigger: Constructing via HttpRequestTool::new_with_config with PathBuf::from(""); runtime wiring that reads a CONFIG_PATH env var which is unset, producing an empty path; passing a config_path that was cleared during initialization; calling resolve_auth_secret on such a tool. The None case (HttpRequestTool::new) raises the sibling error instead.

Common situations: Embedding the tool in a custom host that forgot to locate its config; config path resolution order changing between versions; test harnesses constructing the tool without a config file and then exercising auth_secret.

Related errors

• environment-backed auth_secret references an empty environme
• auth_secret cannot be empty
• auth_secret must be 64 characters or fewer
• auth_secret must contain only ASCII letters, numbers, unders
• auth_secret '{secret_name}' is empty after decryption

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/dd033a69b49d7d7a. Report an issue: GitHub.