CLI

CLI Troubleshooting

Most CLI failures are designed to be diagnosable from kanject doctor, command exit codes, and KANCLI### diagnostic codes.

Start with doctor

bash 
kanject doctor
kanject doctor --env prod

Without --env, doctor checks the foundations. With --env, it also checks stage-specific assumptions such as manifest/stage shape and provider readiness.

Common diagnostics

KANCLI018
The .NET global tools directory is not on PATH.
KANCLI003
The lockfile drifted. Run `kanject sync` and commit the result if intentional.
KANCLI044
`--pull-env` resolved SecureString values into the local process and is warning you explicitly.

Inspect env safely

bash 
kanject env --env dev
kanject env --env dev --show-values

kanject env masks resolved values by default. Use --show-values only in a local debugging terminal, never in CI logs.

Failure patterns

  • Manifest/stage mismatch — every stage listed in the manifest needs a matching stage file.
  • AWS profile/region issue — confirm the profile exists locally and in CI.
  • Artifact bucket missing — create the bucket or let your team IaC provision it before deploy.
  • Cross-repo dependency issue — check git access, pinned refs, and manifest.lock.json drift.