{"record":{"id":"98cc2bff54e4927a","repo":"wavetermdev/waveterm","slug":"failed-to-generate-job-auth-token-w","errorCode":null,"errorMessage":"failed to generate job auth token: %w","messagePattern":"failed to generate job auth token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/jobcontroller/jobcontroller.go","lineNumber":638,"sourceCode":"\tif params.Cmd == \"\" {\n\t\treturn \"\", fmt.Errorf(\"command is required\")\n\t}\n\tif params.TermSize == nil {\n\t\tparams.TermSize = &waveobj.TermSize{Rows: 24, Cols: 80}\n\t}\n\n\tisConnected, err := conncontroller.IsConnected(params.ConnName)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error checking connection status: %w\", err)\n\t}\n\tif !isConnected {\n\t\treturn \"\", fmt.Errorf(\"connection %q is not connected\", params.ConnName)\n\t}\n\n\tjobId := uuid.New().String()\n\tjobAuthToken, err := utilfn.RandomHexString(32)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate job auth token: %w\", err)\n\t}\n\n\tjobAccessClaims := &wavejwt.WaveJwtClaims{\n\t\tMainServer: true,\n\t\tJobId:      jobId,\n\t}\n\tjobAccessToken, err := wavejwt.Sign(jobAccessClaims)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate job access token: %w\", err)\n\t}\n\n\tjob := &waveobj.Job{\n\t\tOID:              jobId,\n\t\tConnection:       params.ConnName,\n\t\tJobKind:          params.JobKind,\n\t\tCmd:              params.Cmd,\n\t\tCmdArgs:          params.Args,\n\t\tCmdEnv:           params.Env,","sourceCodeStart":620,"sourceCodeEnd":656,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/jobcontroller/jobcontroller.go#L620-L656","documentation":"StartJob generates a 32-byte random hex auth token (utilfn.RandomHexString) for the new job; if the CSPRNG read fails, the error is wrapped with this message. This almost never happens on healthy systems and usually signals OS-level entropy/RNG failure.","triggerScenarios":"utilfn.RandomHexString(32) returns an error from the underlying crypto/rand read — e.g. exhausted or inaccessible system entropy source.","commonSituations":"Container with restricted syscalls blocking getrandom, corrupted crypto runtime, extreme resource exhaustion.","solutions":["Retry the StartJob call — the failure is typically transient or environmental.","Inspect the wrapped cause (%w) to identify the OS-level RNG failure.","Fix the host environment (restore /dev/urandom access, unblock getrandom seccomp rule) if it persists."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"jobId, err := jobcontroller.StartJob(ctx, params)\nif err != nil && strings.Contains(err.Error(), \"failed to generate job auth token\") {\n    // transient OS RNG issue: retry once\n    jobId, err = jobcontroller.StartJob(ctx, params)\n}","preventionTips":["Keep host entropy healthy (don't block getrandom via seccomp; ensure /dev/urandom exists in containers).","Treat this error as environmental — alert on it rather than coding around it.","Monitor the wrapped root cause to distinguish transient from persistent RNG failure."],"tags":["crypto","random","environment"],"backgroundTag":"crypto-rand-failure","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}