{"record":{"id":"bbd99d3ced74533f","repo":"aaif-goose/goose","slug":"failed-to-store-secret","errorCode":null,"errorMessage":"Failed to store secret","messagePattern":"Failed to store secret","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/goose-cli/src/commands/configure.rs","lineNumber":1135,"sourceCode":"    let envs = HashMap::new();\n    let mut env_keys = Vec::new();\n    let config = Config::global();\n\n    if !cliclack::confirm(\"Would you like to add environment variables?\").interact()? {\n        return Ok((envs, env_keys));\n    }\n\n    loop {\n        let key: String = cliclack::input(\"Environment variable name:\")\n            .placeholder(\"API_KEY\")\n            .interact()?;\n\n        let value: String = cliclack::password(\"Environment variable value:\")\n            .mask('▪')\n            .interact()?;\n\n        if !try_store_secret(config, &key, value)? {\n            return Err(anyhow::anyhow!(\"Failed to store secret\"));\n        }\n        env_keys.push(key);\n\n        if !cliclack::confirm(\"Add another environment variable?\").interact()? {\n            break;\n        }\n    }\n\n    Ok((envs, env_keys))\n}\n\nfn collect_headers() -> anyhow::Result<HashMap<String, String>> {\n    let mut headers = HashMap::new();\n\n    if !cliclack::confirm(\"Would you like to add custom headers?\").interact()? {\n        return Ok(headers);\n    }\n","sourceCodeStart":1117,"sourceCodeEnd":1153,"githubUrl":"https://github.com/aaif-goose/goose/blob/3810898a7447ec3299be72e223d3570a7aabf0ab/crates/goose-cli/src/commands/configure.rs#L1117-L1153","documentation":"When adding environment variables during `goose configure`, each key/value pair is persisted through try_store_secret, which delegates to the OS secret store/keyring. If storing reports failure, the entry loop aborts with this generic message.","triggerScenarios":"Adding an env var in the configure wizard on a system where the credential store is unavailable: Linux without a running secret service (gnome-keyring/kwallet over dbus), a locked keyring, or an OS keychain access prompt denied.","commonSituations":"Containers, minimal window managers, and SSH sessions with no dbus secret service; locked GNOME keyring at first login; CI runners with no keyring; macOS keychain permission denied for the terminal.","solutions":["Install and unlock a secret service (e.g. gnome-keyring) and ensure DBUS_SESSION_BUS_ADDRESS is set for your session","Run configure from a desktop session where the keyring is already unlocked","Skip storing inside goose: export the variable in your shell profile or .env instead","Retry after granting keychain access to the terminal app"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Linux: verify a secret service is reachable before the wizard\npgrep -x gnome-keyring-daemon >/dev/null 2>&1 \\\n  || echo 'warning: no secret service detected; env-var storage may fail'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provision credentials via env vars in headless/keyringless environments","Unlock the keyring before starting interactive configure","Store one test variable first to fail fast before bulk entry"],"tags":["secrets","keyring","configuration","environment","cli"],"backgroundTag":null,"analyzedSha":"3810898a7447ec3299be72e223d3570a7aabf0ab","analyzedAt":"2026-08-16T10:14:26.282Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}