varlock run crashes when ~/.varlock/config.json contains telemetry anonymousId

[benvinegar]

Authorship note: This issue report was written by an AI coding agent (at operator request), based on direct debugging in a live production-like environment.

Summary

varlock run crashes when ~/.varlock/config.json contains an anonymousId field (telemetry-related).

Error

Error: Anonymous ID should not be set in project varlock config

Stack points to loadVarlockConfig in the packaged CLI (/snapshot/dist-sea/cli-executable.cjs).

What we observed

• varlock load --path ~/.config/ succeeded.
• varlock run --path ~/.config/ -- <command> failed with the error above.
• ~/.varlock/config.json contained:

{
  "anonymousId": "0529b6e3-e76c-43af-a1ea-12c0eed50451"
}

• Removing/renaming this file immediately fixed varlock run.

Impact

This blocked startup of a long-running service because subprocesses are launched via varlock run.

Workaround we used

• Remove/rename ~/.varlock/config.json, OR
• set VARLOCK_TELEMETRY_DISABLED=1 in runtime startup environment.

Why this looks like a bug

A telemetry/user config written/managed by Varlock should not cause varlock run to hard-crash. The error also says "project varlock config" while the failing file appears to be user-level telemetry config.

Request

• Make varlock run tolerant of telemetry fields like anonymousId in user config, or
• Ignore telemetry fields in runtime config loading, and
• Preferably emit a warning instead of throwing.

Happy to provide additional logs if useful.

[theoephraim]

I see whats going on - will have a fix up shortly!

[theoephraim]

It's not exactly what I thought it was - we already ignore ~/.varlock/config.json as a potential project config file, but I think it may have something to do with running things as a different user so os.homedir() isn't matching. I'll just remove that check for now as it's not important.

[benvinegar]

That sounds right. I'm trying to inject env stuff into another lower-permission user (a bot).