agalwood/Motrix · error · SecretStoreError

plugin.lifecycle.secrets_seed_missing

plugin.lifecycle.secrets_seed_missing

Error message

secret store is unavailable in this runtime

What it means

The runtime installed FailingSecretStore because no encryption seed was configured. Its available() returns false and encrypt() always throws this error. Plugins that need to persist secrets cannot operate in this state; the error is the explicit signal rather than silently producing unreadable ciphertext.

Source

Thrown at src/core/plugin/capabilities/secret-store.ts:71

   */
  available(): boolean
}

// ---------------------------------------------------------------------------
// FailingSecretStore — sentinel for "no secrets configured"
// ---------------------------------------------------------------------------

/**
 * Used by tests and by the server impl when no seed is available.
 * available() is always false; encrypt/decrypt always reject.
 */
export class FailingSecretStore implements SecretStore {
  available(): boolean {
    return false
  }

  async encrypt(_plaintext: string): Promise<string> {
    throw new SecretStoreError(
      'plugin.lifecycle.secrets_seed_missing',
      'secret store is unavailable in this runtime'
    )
  }

  async decrypt(_token: string): Promise<string> {
    throw new SecretStoreError(
      'plugin.lifecycle.secrets_seed_missing',
      'secret store is unavailable in this runtime'
    )
  }
}

View on GitHub (pinned to 1a708ee577)

Solutions

1. Configure the encryption seed in the runtime (env var or config) so a real SecretStore is installed.
2. Check secretStore.available() before calling encrypt() and degrade or surface a setup error.
3. Verify the seed is provisioned in deployment automation (CI/CD, IaC).

Example fix

// before
const token = await secretStore.encrypt(secret)

// after
if (!secretStore.available()) throw new Error('configure SECRETS_SEED to enable secret persistence')
const token = await secretStore.encrypt(secret)

if (!secretStore.available()) {
  throw new Error('configure SECRETS_SEED to enable secret persistence')
}
await secretStore.encrypt(plaintext)

function secretsAvailable(s: SecretStore): s is SecretStore & { available(): true } {
  return s.available() === true
}

When it happens

Trigger: Plugin calls secretStore.encrypt() but the runtime was started without a seed (e.g. missing SEED env var, missing config field); dev/test environment never provisioned a seed; production deploy forgot the seed in the new region.

Common situations: New deployment missing the secrets-seed configuration; local dev without the seed; seed rotated/removed; container image lacks the seed mount.

Related errors

• GeoIPSourceUnsupported
• unsupported-encryption
• unsupported-encryption
• Key must be 16 bytes, got ${key.length} from ${uri}
• Key must be 16 bytes, got ${key.length}

AI-assisted analysis of agalwood/Motrix@1a708ee577 (2026-08-12). Data as JSON: /api/errors/6cacd32d37d4d6e8. Report an issue: GitHub.