{"record":{"id":"ca509e8dbfba0c7a","repo":"wavetermdev/waveterm","slug":"failed-to-build-secret-environment-err-secret","errorCode":null,"errorMessage":"failed to build secret environment (ERR-SECRET): %w","messagePattern":"failed to build secret environment \\(ERR-SECRET\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/buildercontroller/buildercontroller.go","lineNumber":317,"sourceCode":"\t\t}\n\t\tbc.lock.Unlock()\n\t}()\n}\n\nfunc (bc *BuilderController) runBuilderApp(ctx context.Context, appId string, appBinPath string, builderEnv map[string]string) (*BuilderProcess, error) {\n\tmanifest, err := waveappstore.ReadAppManifest(appId)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read app manifest: %w\", err)\n\t}\n\n\tsecretBindings, err := waveappstore.ReadAppSecretBindings(appId)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read secret bindings (ERR-SECRET): %w\", err)\n\t}\n\n\tsecretEnv, err := waveappstore.BuildAppSecretEnv(appId, manifest, secretBindings)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to build secret environment (ERR-SECRET): %w\", err)\n\t}\n\n\tif builderEnv == nil {\n\t\tbuilderEnv = make(map[string]string)\n\t}\n\tfor k, v := range secretEnv {\n\t\tbuilderEnv[k] = v\n\t}\n\n\tcmd := exec.Command(appBinPath)\n\tcmd.Env = append(os.Environ(), \"TSUNAMI_CLOSEONSTDIN=1\")\n\n\tif wavebase.IsDevMode() {\n\t\tcmd.Env = append(cmd.Env, \"TSUNAMI_CORS=\"+tsunamiutil.DevModeCorsOrigins)\n\t}\n\n\tfor key, value := range builderEnv {\n\t\tcmd.Env = append(cmd.Env, key+\"=\"+value)","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/buildercontroller/buildercontroller.go#L299-L335","documentation":"runBuilderApp calls waveappstore.BuildAppSecretEnv(appId, manifest, secretBindings) to turn the manifest + bindings into environment variables. This ERR-SECRET error means a binding could not be resolved into an env value — e.g. a bound secret does not exist in the secrets store, or the manifest declares a binding inconsistent with stored bindings.","triggerScenarios":"BuildAppSecretEnv fails — binding references a secret name not present in the store, a secret value was deleted after being bound, or manifest/binding schema mismatch.","commonSituations":"Secret deleted from the store while still bound to the app; user edited the app manifest adding a binding without provisioning the secret; namespace mismatch between binding and secret store.","solutions":["Re-bind or re-create the missing secret in the secrets store","Compare manifest-declared bindings with stored bindings and remove stale ones","Re-provision secrets via the secrets UI so binding names match exactly","Check the app namespace used for lookup matches where secrets were stored"],"exampleFix":"// before\n// binding \"API_KEY\" -> secret deleted\n// after\nwaveappstore.SetAppSecret(appNS, \"API_KEY\", newValue) // then rebuild/restart the app","handlingStrategy":"validation","validationCode":"bindings, _ := waveappstore.ReadAppSecretBindings(appId)\nfor name := range bindings {\n    if _, err := waveappstore.GetSecret(appNS, name); err != nil {\n        return fmt.Errorf(\"missing secret %q bound to app\", name)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := runApp(appId); err != nil {\n    if strings.Contains(err.Error(), \"failed to build secret environment\") {\n        // re-bind or recreate the missing secret\n    }\n}","preventionTips":["Keep manifest bindings in sync with the secrets store","Delete/re-bind secrets atomically with app manifest changes","Validate all bound secret names exist before launching the app"],"tags":["go","secrets","environment"],"backgroundTag":"secret-resolution-failed","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}