warn when a deploy sets a reserved env var (KERNEL-1620) - #230
Merged
Conversation
KERNEL_API_KEY and ENTRYPOINT_RELPATH are set by the platform on every deployment and a user-supplied value is silently overridden. Print a warning at deploy time (both the file/CLI and GitHub-source paths) so a dropped value does not surprise the user later. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
akxue
marked this pull request as ready for review
August 17, 2026 17:52
ehfeng
approved these changes
Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
surfaces the silent
KERNEL_API_KEYoverride to the user at deploy time.right now if you set
KERNEL_API_KEYvia--env/--env-file, the platform overrides it with the per-deployment key and your value is silently dropped — no signal, and it's the reason behind KERNEL-1620 / a pylon thread. this prints apterm.Warning(same convention as the existing "Requested --per-page N; capped to 100" warnings) when a reserved var is supplied, on both deploy paths (file/CLI + github source):KERNEL_API_KEYandENTRYPOINT_RELPATH; guarded behindoutput != "json"so json output stays clean.log.WarnContextbreadcrumb for the SDK/API deploy paths (separate kernel/kernel PR), and the deployment key lifecycle + reserved vars are now documented (kernel/docs #504).did not go with respecting a user-supplied key — they can already pass their own under a non-reserved name and read it explicitly, so honoring
KERNEL_API_KEYwould just add ambiguity.🤖 Generated with Claude Code
Note
Low Risk
CLI-only UX change with no deploy API or override logic modified; low risk aside from extra stderr warnings in interactive mode.
Overview
Adds deploy-time warnings when
--env/--env-fileincludes platform-reserved variables (KERNEL_API_KEY,ENTRYPOINT_RELPATH), which the backend overwrites and previously dropped without feedback.Introduces
warnReservedEnvVarsincmd/deploy.go(aligned with the API deploy activity’s reserved set) and invokes it after env merging on both local/file deploy and GitHub source deploy, using the samepterm.Warningstyle as other CLI caps. Warnings are skipped when-o jsonso machine output stays clean. Deploy behavior is unchanged—warn-only.Reviewed by Cursor Bugbot for commit eff437b. Bugbot is set up for automated code reviews on this repo. Configure here.