{"record":{"id":"428773a98f8b0a84","repo":"xpipe-io/xpipe","slug":"unknown-askpass-request","errorCode":null,"errorMessage":"Unknown askpass request","messagePattern":"Unknown askpass request","errorType":"exception","errorClass":"BeaconClientException","httpStatus":400,"severity":"error","filePath":"app/src/main/java/io/xpipe/app/beacon/api/AskpassExchange.java","lineNumber":89,"sourceCode":"            return Response.builder().value(InPlaceSecretValue.of(\"\")).build();\n        }\n\n        var prompt = msg.getPrompt();\n        // sudo-rs uses a different prefix which we don't really need\n        prompt = prompt.replace(\"[sudo: authenticate]\", \"[sudo]\");\n\n        if (msg.getRequest() == null) {\n            var r = AskpassAlert.queryRaw(prompt, null, false);\n            return Response.builder()\n                    .value(r.getState() == SecretQueryState.NORMAL ? r.getSecret() : InPlaceSecretValue.of(\"\"))\n                    .build();\n        }\n\n        var found = msg.getSecretId() != null\n                ? SecretManager.getProgress(msg.getRequest(), msg.getSecretId())\n                : SecretManager.getProgress(msg.getRequest());\n        if (found.isEmpty()) {\n            throw new BeaconClientException(\"Unknown askpass request\");\n        }\n\n        var p = found.get();\n        var secret = p.process(prompt);\n        if (p.getState() != SecretQueryState.NORMAL) {\n            var ex = new BeaconClientException(SecretQueryState.toErrorMessage(p.getState()));\n            ErrorEventFactory.preconfigure(ErrorEventFactory.fromThrowable(ex).ignore());\n            throw ex;\n        }\n        focusTerminalIfNeeded(msg.getPid());\n        return Response.builder().value(secret.inPlace()).build();\n    }\n\n    @Override\n    public boolean requiresEnabledApi() {\n        return false;\n    }\n","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/xpipe-io/xpipe/blob/d85ca821baa46092a320ebb13546d7240adb74f8/app/src/main/java/io/xpipe/app/beacon/api/AskpassExchange.java#L71-L107","documentation":"AskpassExchange resolves an interactive password prompt to a registered secret-query progress previously set up for that request. When neither the request id alone nor request+secretId matches a known progress entry in SecretManager, the handler throws BeaconClientException('Unknown askpass request').","triggerScenarios":"An askpass prompt arrives for a request whose progress entry already completed or was cleaned up; the secretId doesn't correspond to a progress registered for that request id; the daemon restarted between query registration and prompt; sending prompts for requests never initiated through the API.","commonSituations":"Scripts replaying captured askpass messages out of order; timeouts cancelling the query before the prompt is answered; multiple concurrent queries causing id mix-ups; stale clients after a daemon restart.","solutions":["Re-initiate the original request that required the secret so a fresh askpass progress is registered, then answer its prompts.","Verify the request id and secretId in the askpass message match the currently active query (check for typos or reused ids).","Ensure prompts are answered promptly before the query times out or completes.","After a daemon restart, restart the whole connection flow instead of replaying old askpass messages."],"exampleFix":"// before\nanswerPrompt(oldRequestId, secretId, password); // progress already gone\n// after\nvar req = client.startConnection(connId); // registers a fresh query\nanswerPrompt(req.getRequestId(), req.getSecretId(), password);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    answerAskpass(requestId, secretId, password);\n} catch (BeaconClientException e) {\n    if (e.getMessage().contains(\"Unknown askpass request\")) {\n        // query expired/completed: restart the connection flow to register a new query\n        restartConnectionFlow();\n    }\n}","preventionTips":["Answer askpass prompts promptly before the query times out","Always use the request id and secretId returned by the current flow, not cached ones","After daemon restarts, redo the full connection flow instead of replaying prompts"],"tags":["beacon","askpass","secret","stale-state"],"backgroundTag":"resource-not-found","analyzedSha":"d85ca821baa46092a320ebb13546d7240adb74f8","analyzedAt":"2026-09-06T14:30:08.251Z","contentChangedAt":"2026-09-06T14:30:08.251Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}