{"record":{"id":"5cd0f764ab3d290b","repo":"wavetermdev/waveterm","slug":"invalid-secret-name-must-start-with-a-letter-and","errorCode":null,"errorMessage":"invalid secret name: must start with a letter and contain only letters, numbers, and underscores","messagePattern":"invalid secret name: must start with a letter and contain only letters, numbers, and underscores","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/wsh/cmd/wshcmd-secret.go","lineNumber":85,"sourceCode":"\nfunc init() {\n\tsecretUiCmd.Flags().BoolVarP(&secretUiMagnified, \"magnified\", \"m\", false, \"open secrets UI in magnified mode\")\n\trootCmd.AddCommand(secretCmd)\n\tsecretCmd.AddCommand(secretGetCmd)\n\tsecretCmd.AddCommand(secretSetCmd)\n\tsecretCmd.AddCommand(secretListCmd)\n\tsecretCmd.AddCommand(secretDeleteCmd)\n\tsecretCmd.AddCommand(secretUiCmd)\n}\n\nfunc secretGetRun(cmd *cobra.Command, args []string) (rtnErr error) {\n\tdefer func() {\n\t\tsendActivity(\"secret\", rtnErr == nil)\n\t}()\n\n\tname := args[0]\n\tif !secretNameRegex.MatchString(name) {\n\t\treturn fmt.Errorf(\"invalid secret name: must start with a letter and contain only letters, numbers, and underscores\")\n\t}\n\n\tresp, err := wshclient.GetSecretsCommand(RpcClient, []string{name}, &wshrpc.RpcOpts{Timeout: 2000})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting secret: %w\", err)\n\t}\n\n\tvalue, ok := resp[name]\n\tif !ok {\n\t\treturn fmt.Errorf(\"secret not found: %s\", name)\n\t}\n\n\tWriteStdout(\"%s\\n\", value)\n\treturn nil\n}\n\nfunc secretSetRun(cmd *cobra.Command, args []string) (rtnErr error) {\n\tdefer func() {","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/cmd/wsh/cmd/wshcmd-secret.go#L67-L103","documentation":"The `wsh secret get` command validates the secret name locally against secretNameRegex (`^[A-Za-z][A-Za-z0-9_]*$`) before making any RPC call, mirroring the server-side validation in pkg/wconfig/secretstore.go. If the name contains hyphens, dots, leading digits, or other symbols, the command fails fast with this error without contacting the daemon. It exists to keep client and server naming rules consistent and avoid wasted RPC round-trips.","triggerScenarios":"Running `wsh secret get` with a name violating the regex: e.g. `wsh secret get api-key` (hyphen), `wsh secret get my.secret` (dot), `wsh secret get 1token` (leading digit), or a name with spaces/special characters.","commonSituations":"Secrets were set with different naming conventions (kebab-case from CI tools like AWS/GitHub, e.g. SECRET-API-KEY); users copy environment-variable-like names with dots (e.g. db.host); automation scripts pass names derived from file names or domains.","solutions":["Rename the argument to match ^[A-Za-z][A-Za-z0-9_]*$: start with a letter, use only letters, digits, underscores (e.g. api_key instead of api-key).","Run `wsh secret list` to see valid existing secret names and pick the correct one.","If the secret must be stored under a hyphenated external name, store it under a compliant alias (e.g. `wsh secret set api_key=...`) and reference that instead.","If you believe a valid name is rejected, check the regex in cmd/wsh/cmd/wshcmd-secret.go:18 and pkg/wconfig/secretstore.go for version mismatches between wsh CLI and daemon."],"exampleFix":"// before\nwsh secret get api-key\n// after\nwsh secret get api_key","handlingStrategy":"validation","validationCode":"var secretNameRe = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_]*$`)\nif !secretNameRe.MatchString(name) {\n    return fmt.Errorf(\"name %q must match ^[A-Za-z][A-Za-z0-9_]*$\", name)\n}","typeGuard":"func isValidSecretName(s string) bool {\n    return regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_]*$`).MatchString(s)\n}","tryCatchPattern":null,"preventionTips":["Normalize external names (kebab/dotted) to snake_case before calling wsh secret commands","Keep a single shared regex constant in sync with pkg/wconfig/secretstore.go","Validate names at script start and fail fast with a clear message","Prefer listing (`wsh secret list`) to confirm exact names before get/delete"],"tags":["validation","cli","naming"],"backgroundTag":"invalid-secret-name","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}