{"record":{"id":"f62e7f9f6b116a52","repo":"wavetermdev/waveterm","slug":"failed-to-get-secret-q-w","errorCode":null,"errorMessage":"failed to get secret %q: %w","messagePattern":"failed to get secret %q: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/waveappstore/waveappstore.go","lineNumber":828,"sourceCode":"\t\tbindings = make(map[string]string)\n\t}\n\n\tsecretEnv := make(map[string]string)\n\n\tfor secretName, secretMeta := range manifest.Secrets {\n\t\tboundSecretName, hasBinding := bindings[secretName]\n\n\t\tif !secretMeta.Optional && !hasBinding {\n\t\t\treturn nil, fmt.Errorf(\"required secret %q is not bound\", secretName)\n\t\t}\n\n\t\tif !hasBinding {\n\t\t\tcontinue\n\t\t}\n\n\t\tsecretValue, exists, err := secretstore.GetSecret(boundSecretName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get secret %q: %w\", boundSecretName, err)\n\t\t}\n\n\t\tif !exists {\n\t\t\tif !secretMeta.Optional {\n\t\t\t\treturn nil, fmt.Errorf(\"required secret %q is bound to %q which does not exist in secret store\", secretName, boundSecretName)\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\n\t\tsecretEnv[secretName] = secretValue\n\t}\n\n\treturn secretEnv, nil\n}\n","sourceCodeStart":810,"sourceCodeEnd":843,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/waveappstore/waveappstore.go#L810-L843","documentation":"For each bound secret, BuildAppSecretEnv calls secretstore.GetSecret(boundSecretName). If the secret store itself returns an error (as opposed to a clean 'not exists'), the lookup is aborted and wrapped as 'failed to get secret %q'. This signals a malfunction of the secret store backend, not a missing binding.","triggerScenarios":"secretstore.GetSecret returns a non-nil error: corrupted/locked store backend, keychain access denied (OS keychain prompt rejected), store file unreadable, or backend initialization failure while resolving the bound key name.","commonSituations":"OS keychain is locked or denied access to the process (Linux secret service not running, macOS Keychain prompt denied, Windows Credential Manager issue); the secret store file was manually edited and corrupted; running headless where the keychain daemon is unavailable.","solutions":["Inspect the wrapped %w error to identify the backend failure (access denied vs corruption)","Unlock the OS keychain / start the secret service (gnome-keyring, keychain daemon) and retry","Verify the bound key name is a valid store key (no stray whitespace or wrong key)","Test the key directly with secretstore.GetSecret to reproduce outside BuildAppSecretEnv","If the store file is corrupted, restore it from backup or re-enter the secrets"],"exampleFix":"// before\nval, exists, err := secretstore.GetSecret(\" myapp/api-key\") // key has leading space -> backend error\n// after\nkey := strings.TrimSpace(\"myapp/api-key\")\nval, exists, err := secretstore.GetSecret(key)\nif err != nil { return fmt.Errorf(\"secret store unavailable: %w\", err) }","handlingStrategy":"try-catch","validationCode":"for _, bound := range bindings {\n    if _, _, err := secretstore.GetSecret(strings.TrimSpace(bound)); err != nil {\n        return fmt.Errorf(\"secret store precheck failed for %q: %w\", bound, err)\n    }\n}","typeGuard":"func secretStoreHealthy(keys []string) bool {\n    for _, k := range keys {\n        if _, _, err := secretstore.GetSecret(k); err != nil { return false }\n    }\n    return true\n}","tryCatchPattern":"env, err := waveappstore.BuildAppSecretEnv(appId, manifest, bindings)\nif err != nil && strings.Contains(err.Error(), \"failed to get secret\") {\n    return fmt.Errorf(\"secret store backend failure, check keychain/daemon: %w\", err)\n}","preventionTips":["Ensure the OS keychain/secret service is running and unlocked before launching apps","Trim and normalize bound key names before storing them","Test GetSecret on the key directly when debugging","Avoid editing the secret store file by hand"],"tags":["go","secrets","keychain"],"backgroundTag":"secret-store-unavailable","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}