{"record":{"id":"22a34ccc42144bda","repo":"coleam00/Archon","slug":"github-app-mode-misconfigured-github-app-id-and-w","errorCode":null,"errorMessage":"GitHub App mode misconfigured: GITHUB_APP_ID and WEBHOOK_SECRET required","messagePattern":"GitHub App mode misconfigured: GITHUB_APP_ID and WEBHOOK_SECRET required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"packages/server/src/index.ts","lineNumber":433,"sourceCode":"      throw new Error(ghAuthMode.message);\n    }\n    const hasGitHub = ghAuthMode.kind !== 'none';\n    const hasGitea = Boolean(\n      process.env.GITEA_URL && process.env.GITEA_TOKEN && process.env.GITEA_WEBHOOK_SECRET\n    );\n    const hasGitLab = Boolean(process.env.GITLAB_TOKEN && process.env.GITLAB_WEBHOOK_SECRET);\n\n    if (!hasTelegram && !hasDiscord && !hasGitHub && !hasGitea && !hasGitLab) {\n      getLog().warn('no_platform_adapters_configured');\n    }\n\n    if (ghAuthMode.kind === 'app') {\n      // Locals avoid `!` non-null assertions: hasGitHubApp already guarantees\n      // GITHUB_APP_ID and WEBHOOK_SECRET are set, but the linter can't infer that.\n      const appId = process.env.GITHUB_APP_ID;\n      const webhookSecret = process.env.WEBHOOK_SECRET;\n      if (!appId || !webhookSecret) {\n        throw new Error('GitHub App mode misconfigured: GITHUB_APP_ID and WEBHOOK_SECRET required');\n      }\n      const privateKey = loadAppPrivateKey();\n      // Fail fast on a malformed TOKEN_ENCRYPTION_KEY when per-user is enabled,\n      // so we never store unencryptable tokens at runtime. If the key is absent,\n      // per-user GitHub is simply disabled (App-for-bot-only remains valid).\n      assertEncryptionKeyAtBoot();\n      if (!isPerUserGitHubEnabled()) {\n        getLog().warn(\n          'github_app.per_user_disabled — set TOKEN_ENCRYPTION_KEY (and GITHUB_APP_CLIENT_ID) to enable per-user GitHub identity'\n        );\n      }\n      const defaultInstallationId = process.env.GITHUB_APP_INSTALLATION_ID\n        ? Number(process.env.GITHUB_APP_INSTALLATION_ID)\n        : undefined;\n      githubAppAuthProvider = createGitHubAppAuthProvider({\n        appId,\n        privateKey,\n        slug: process.env.GITHUB_APP_SLUG ?? 'archon',","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/coleam00/Archon/blob/0773b9745896ef0612e709c80845a0f7db315b19/packages/server/src/index.ts#L415-L451","documentation":"In GitHub App mode, startServer requires both GITHUB_APP_ID and WEBHOOK_SECRET to construct the GitHubAdapter; if either is missing at this point it throws a descriptive Error instead of building a partially configured adapter. Normally the mode selector (`hasGitHubApp`/selectGitHubAuthMode) guarantees both are present, so this is a fail-fast invariant check guarding the locals used below it.","triggerScenarios":"selectGitHubAuthMode() returned kind === 'app' but process.env.GITHUB_APP_ID or process.env.WEBHOOK_SECRET is empty/undefined when read inside the app branch — e.g. a variable set to an empty string, or mode inference triggered by other App-related env vars while the required ones are unset.","commonSituations":"GITHUB_APP_ID set but WEBHOOK_SECRET forgotten when wiring GitHub App webhooks; an env var defined as empty (`GITHUB_APP_ID=`) in .env; stale container environment after rotating credentials; docs followed partially during App-mode setup.","solutions":["Set both GITHUB_APP_ID and WEBHOOK_SECRET in the server environment and restart.","Check for empty-string definitions in .env (`VAR=` counts as set-but-empty to some loaders but not to this check) and fill in real values.","If you don't intend App mode, remove the App variables so the selector picks PAT or none.","Re-run `archon setup` to regenerate a complete GitHub App configuration."],"exampleFix":"# before\nGITHUB_APP_ID=Iv1.xxxx\n# WEBHOOK_SECRET missing\n# after\nGITHUB_APP_ID=Iv1.xxxx\nWEBHOOK_SECRET=whsec_xxx","handlingStrategy":"validation","validationCode":"for (const k of ['GITHUB_APP_ID', 'WEBHOOK_SECRET']) {\n  const v = process.env[k];\n  if (!v || v.trim() === '') throw new Error(`${k} must be set for GitHub App mode`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await startServer(config);\n} catch (e) {\n  if (/GitHub App mode misconfigured/i.test(e?.message ?? '')) {\n    logFatal('Set GITHUB_APP_ID and WEBHOOK_SECRET (App mode) in the server environment.');\n    process.exit(1);\n  }\n  throw e;\n}","preventionTips":["Use `archon setup` to generate App-mode env vars so none are skipped.","Beware empty-string env entries (`VAR=`) — they fail this check.","Re-verify environment after credential rotation or container recreation.","Confirm WEBHOOK_SECRET matches the secret configured on the GitHub App webhook."],"tags":["configuration","github","github-app","env","startup"],"backgroundTag":"missing-env-var","analyzedSha":"0773b9745896ef0612e709c80845a0f7db315b19","analyzedAt":"2026-09-01T02:28:07.064Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}