{"record":{"id":"308c50b282474a11","repo":"tinyhumansai/openhuman","slug":"unknown-secret-ref","errorCode":null,"errorMessage":"unknown secret ref {}","messagePattern":"unknown secret ref (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/openhuman/mcp/registry/setup.rs","lineNumber":182,"sourceCode":"        }\n    }\n}\n\n/// Resolve a `{KEY: SecretRef}` map into a `Vec<(KEY, VALUE)>`. Returns\n/// `Err(_)` if any ref is unknown or not yet fulfilled — callers should\n/// retry rather than partially-apply.\n///\n/// Touches the `last_touched` on every hit so iterative `test_connection`\n/// calls reset the idle TTL.\npub async fn resolve_refs(\n    refs: &HashMap<String, SecretRef>,\n) -> anyhow::Result<Vec<(String, String)>> {\n    let mut guard = map().lock().await;\n    let mut out = Vec::with_capacity(refs.len());\n    for (key, r) in refs {\n        let entry = guard\n            .get_mut(r)\n            .ok_or_else(|| anyhow::anyhow!(\"unknown secret ref {}\", r.as_str()))?;\n        let value = entry\n            .value\n            .clone()\n            .ok_or_else(|| anyhow::anyhow!(\"secret ref {} not yet fulfilled\", r.as_str()))?;\n        entry.last_touched = Instant::now();\n        out.push((key.clone(), value));\n    }\n    Ok(out)\n}\n\n/// Same as [`resolve_refs`] but also removes the entries from the map on\n/// success. Used by `install_and_connect` once the values have been\n/// persisted to `mcp_client_env`. On failure the entries are left intact\n/// so the agent can retry without re-prompting.\npub async fn consume_refs(\n    refs: &HashMap<String, SecretRef>,\n) -> anyhow::Result<Vec<(String, String)>> {\n    // First pass: resolve. Bail without mutation if any ref is missing.","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/mcp/registry/setup.rs#L164-L200","documentation":"resolve_refs hit a SecretRef that is absent from the in-memory pending-secret map — the OAuth/credential flow that was supposed to store it never completed or was cleared. Deliberately an Err so callers do not partially apply secrets.","triggerScenarios":"Thrown at src/openhuman/mcp/registry/setup.rs:182 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-run the credential/OAuth flow that fulfils this secret ref","Check for TTL expiry that evicted the entry from the pending map","Verify the ref key matches the one issued at request time"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}