{"record":{"id":"13b35b1496f7fda2","repo":"wavetermdev/waveterm","slug":"no-appropriate-secret-manager-found-cannot-set-se","errorCode":null,"errorMessage":"No appropriate secret manager found, cannot set secrets","messagePattern":"No appropriate secret manager found, cannot set secrets","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/wsh/cmd/wshcmd-secret.go","lineNumber":125,"sourceCode":"\tparts := strings.SplitN(args[0], \"=\", 2)\n\tif len(parts) != 2 {\n\t\treturn fmt.Errorf(\"invalid format: expected [name]=[value]\")\n\t}\n\n\tname := parts[0]\n\tvalue := parts[1]\n\n\tif name == \"\" {\n\t\treturn fmt.Errorf(\"secret name cannot be empty\")\n\t}\n\n\tbackend, err := wshclient.GetSecretsLinuxStorageBackendCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"checking secret storage backend: %w\", err)\n\t}\n\n\tif backend == \"basic_text\" || backend == \"unknown\" {\n\t\treturn fmt.Errorf(\"No appropriate secret manager found, cannot set secrets\")\n\t}\n\n\tsecrets := map[string]*string{name: &value}\n\terr = wshclient.SetSecretsCommand(RpcClient, secrets, &wshrpc.RpcOpts{Timeout: 2000})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"setting secret: %w\", err)\n\t}\n\n\tWriteStdout(\"secret set: %s\\n\", name)\n\treturn nil\n}\n\nfunc secretListRun(cmd *cobra.Command, args []string) (rtnErr error) {\n\tdefer func() {\n\t\tsendActivity(\"secret\", rtnErr == nil)\n\t}()\n\n\tnames, err := wshclient.GetSecretsNamesCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/cmd/wsh/cmd/wshcmd-secret.go#L107-L143","documentation":"Before writing a secret, the CLI queries the Linux storage backend and refuses to proceed if it reports `basic_text` (plaintext file fallback) or `unknown`. Wave only allows secrets to be stored in a real secret manager (e.g. gnome-keyring/secret-service or KWallet); this prevents silently writing credentials to an unencrypted file or an undetectable store. Note the check only runs on this set path — it reflects the daemon's evaluation of the local environment.","triggerScenarios":"Running `wsh secret set NAME=VALUE` on a Linux system where no proper secret service is available: headless servers, containers, WSL without secret-service, or desktops where the keyring is locked/uninstalled, so the daemon reports basic_text or unknown.","commonSituations":"CI runners and Docker images without D-Bus/keyring; fresh Linux installs without gnome-keyring; SSH sessions where the user keyring session isn't unlocked; WSL2 setups lacking secret-service providers like gnome-keyring with dbus.","solutions":["Install and start a secret service: e.g. `sudo apt install gnome-keyring` and ensure `dbus-run-session`/secret-service is available in your session (or use KWallet on KDE).","Unlock your keyring (log into the desktop session, or unlock gnome-keyring via `echo -n 'pass' | gnome-keyring-daemon --unlock`).","For headless/CI use, run secrets through a Wave instance on a machine with a working keyring, or store configuration values in wconfig files instead of the secrets store.","If a keyring is actually running but reported unknown, update Wave Terminal — backend detection may not support your secret manager version."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"backend, err := wshclient.GetSecretsLinuxStorageBackendCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})\nif err != nil { return err }\nif backend == \"basic_text\" || backend == \"unknown\" {\n    return fmt.Errorf(\"install/start gnome-keyring or KWallet before setting secrets\")\n}","typeGuard":"func hasSecureSecretBackend(backend string) bool {\n    return backend != \"basic_text\" && backend != \"unknown\" && backend != \"\"\n}","tryCatchPattern":null,"preventionTips":["Provision a secret manager (gnome-keyring/secret-service or KWallet) on any Linux host where you set secrets","Unlock the user keyring before scripted secret writes (log into the desktop session or use gnome-keyring-daemon --unlock)","In containers/CI, avoid the secrets store; use wconfig files or external secret managers instead","Check the backend with a probe command before batch-setting secrets"],"tags":["linux","keyring","environment","secrets"],"backgroundTag":"no-secret-backend-available","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}