{"record":{"id":"8b06305d0b33a8e0","repo":"wavetermdev/waveterm","slug":"error-making-jwt-token-w-8b0630","errorCode":null,"errorMessage":"error making jwt token: %w","messagePattern":"error making jwt token: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/blockcontroller/shellcontroller.go","lineNumber":444,"sourceCode":"\tblocklogger.Debugf(logCtx, \"[conndebug] created swaptoken: %s\\n\", swapToken.Token)\n\tif connUnion.ConnType == ConnType_Wsl {\n\t\twslConn := connUnion.WslConn\n\t\tif !connUnion.WshEnabled {\n\t\t\tshellProc, err = shellexec.StartWslShellProcNoWsh(ctx, rc.TermSize, cmdStr, cmdOpts, wslConn)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t} else {\n\t\t\tsockName := wslConn.GetDomainSocketName()\n\t\t\trpcContext := wshrpc.RpcContext{\n\t\t\t\tProcRoute: true,\n\t\t\t\tSockName:  sockName,\n\t\t\t\tBlockId:   bc.BlockId,\n\t\t\t\tConn:      wslConn.GetName(),\n\t\t\t}\n\t\t\tjwtStr, err := wshutil.MakeClientJWTToken(rpcContext)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error making jwt token: %w\", err)\n\t\t\t}\n\t\t\tswapToken.RpcContext = &rpcContext\n\t\t\tswapToken.Env[wshutil.WaveJwtTokenVarName] = jwtStr\n\t\t\tshellProc, err = shellexec.StartWslShellProc(ctx, rc.TermSize, cmdStr, cmdOpts, wslConn)\n\t\t\tif err != nil {\n\t\t\t\twslConn.SetWshError(err)\n\t\t\t\twslConn.WshEnabled.Store(false)\n\t\t\t\tblocklogger.Infof(logCtx, \"[conndebug] error starting wsl shell proc with wsh: %v\\n\", err)\n\t\t\t\tblocklogger.Infof(logCtx, \"[conndebug] attempting install without wsh\\n\")\n\t\t\t\tshellProc, err = shellexec.StartWslShellProcNoWsh(ctx, rc.TermSize, cmdStr, cmdOpts, wslConn)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, err\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} else if connUnion.ConnType == ConnType_Ssh {\n\t\tconn := connUnion.SshConn\n\t\tif !connUnion.WshEnabled {","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/blockcontroller/shellcontroller.go#L426-L462","documentation":"Wraps a failure from wshutil.MakeClientJWTToken while building the auth token injected into the environment for a WSL shell process. The JWT authenticates the wsh client back to Wave over the domain socket; without it the spawned shell cannot speak the wsh RPC protocol.","triggerScenarios":"StartWslShellProc path: wshutil.MakeClientJWTToken(rpcContext) returns an error, typically because the Wave key/secret material needed to sign the token is missing or unreadable.","commonSituations":"~/.waveterm secret/key files missing, zero-length, or with wrong permissions (e.g. app data copied between machines/users); running Wave with a different HOME so the key isn't found; first-run initialization interrupted so keys were never generated.","solutions":["Verify Wave's key/secret files exist in the data directory with correct permissions and regenerate them if missing","Ensure HOME/XDG paths point to the same data directory used when keys were created","Restart Wave so key initialization runs again","If migrating machines, copy the whole ~/.waveterm data dir (including key material), not just config"],"exampleFix":"// before: signing with whatever key is present\njwtStr, err := wshutil.MakeClientJWTToken(rpcContext)\n\n// after: ensure key material is initialized first\nif err := wshutil.EnsureKeyInitialized(); err != nil {\n    return nil, fmt.Errorf(\"key material missing, reinit wave data dir: %w\", err)\n}\njwtStr, err := wshutil.MakeClientJWTToken(rpcContext)","handlingStrategy":"try-catch","validationCode":"// ensure signing key exists before starting shells\nif _, err := wshutil.GetWaveKey(); err != nil {\n    return fmt.Errorf(\"wave key unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"proc, err := bc.setupAndStartShellProcess(logCtx, rc, blockMeta)\nif err != nil && strings.Contains(err.Error(), \"error making jwt token\") {\n    // reinit key material and retry once\n}","preventionTips":["Verify key files exist with 600 permissions in the wave data dir","Copy entire data dir (keys included) when migrating machines","Restart Wave after any change to HOME/data-dir env vars"],"tags":["jwt","auth","wsh"],"backgroundTag":"jwt-token-generation-failed","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}