{"record":{"id":"e86729ca48f991bc","repo":"gastownhall/beads","slug":"credential-command-failed-w","errorCode":null,"errorMessage":"credential command failed: %w","messagePattern":"credential command failed: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/creds/command.go","lineNumber":123,"sourceCode":"// resolveCredentialToken returns the token (and any username/expiry) for the given\n// helper command, using a process-level cache keyed by the command so repeated opens\n// don't re-spawn the helper until the token is near expiry. It is concurrency-safe.\nfunc resolveCredentialToken(ctx context.Context, command string) (token, username string, expiry time.Time, err error) {\n\tnow := time.Now()\n\n\tcredCacheMu.Lock()\n\tif c, ok := credCache[command]; ok && now.Before(c.expires.Add(-credExpirySkew)) {\n\t\ttok, user, exp := c.token, c.username, c.expires\n\t\tcredCacheMu.Unlock()\n\t\treturn tok, user, exp, nil\n\t}\n\tcredCacheMu.Unlock()\n\n\trunCtx, cancel := context.WithTimeout(ctx, credCommandTimeout)\n\tdefer cancel()\n\traw, err := credRunner(runCtx, command)\n\tif err != nil {\n\t\treturn \"\", \"\", time.Time{}, fmt.Errorf(\"credential command failed: %w\", err)\n\t}\n\ttoken, username, expiry, err = parseCredential(raw)\n\tif err != nil {\n\t\treturn \"\", \"\", time.Time{}, err\n\t}\n\tif expiry.IsZero() {\n\t\texpiry = now.Add(credDefaultTTL)\n\t}\n\n\tcredCacheMu.Lock()\n\tcredCache[command] = cachedCred{token: token, username: username, expires: expiry}\n\tcredCacheMu.Unlock()\n\treturn token, username, expiry, nil\n}\n\n// parseCredential extracts the token (and any username/expiry) from a helper's\n// stdout. A JSON object is read as the ExecCredential/getToken envelope; otherwise\n// the trimmed output is taken as a bare token. A bare value containing whitespace is","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/creds/command.go#L105-L141","documentation":"resolveCredentialToken runs the configured credential command under a timeout via credRunner. If the command itself fails (non-zero exit, not runnable, timeout), the failure is wrapped with the 'credential command failed:' prefix so the caller knows which stage of token resolution broke.","triggerScenarios":"The credential command is not found on PATH (exec.ErrNotFound), exits non-zero, or exceeds credCommandTimeout and is killed via the runCtx context deadline.","commonSituations":"Misconfigured credential command string in config; helper binary uninstalled or renamed after a version change; slow helper (network auth) hitting the command timeout; helper crashing on startup.","solutions":["Inspect the wrapped cause: 'executable file not found' means fix PATH or the configured command; 'exit status N' means debug the helper's stderr; 'context deadline exceeded' means the helper is too slow.","Install or reinstall the credential helper binary and confirm it is on PATH.","Run the credential command manually to verify it outputs a token.","If the helper is slow, check network connectivity to the auth provider (e.g. `gh auth status`)."],"exampleFix":"// before\ncredentialCommand = \"gh-helper-missing\"\n// after\ncredentialCommand = \"gh\"  // verified: gh auth token works on this machine","handlingStrategy":"try-catch","validationCode":"if _, err := exec.LookPath(strings.Fields(command)[0]); err != nil {\n    // command not found; repair before calling Resolve\n}","typeGuard":null,"tryCatchPattern":"token, _, _, err := creds.Resolve(ctx)\nif err != nil && strings.Contains(err.Error(), \"credential command failed\") {\n    // fall back to another source or prompt the user\n    return fmt.Errorf(\"resolve token: %w\", err)\n}","preventionTips":["Verify the configured credential command exists on PATH on every machine bd runs on.","Keep helper runtime well under the command timeout (avoid network-heavy helpers or pre-warm auth).","Handle 'context deadline exceeded' by checking helper latency."],"tags":["credentials","exec","timeout"],"backgroundTag":"credential-helper-failed","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}