{"record":{"id":"fd9114f8084cc110","repo":"wavetermdev/waveterm","slug":"error-deleting-secret-q-w","errorCode":null,"errorMessage":"error deleting secret %q: %w","messagePattern":"error deleting secret %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/wshrpc/wshserver/wshserver.go","lineNumber":1502,"sourceCode":"\t\t}\n\t}\n\treturn result, nil\n}\n\nfunc (ws *WshServer) GetSecretsNamesCommand(ctx context.Context) ([]string, error) {\n\tnames, err := secretstore.GetSecretNames()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"error getting secret names: %w\", err)\n\t}\n\treturn names, nil\n}\n\nfunc (ws *WshServer) SetSecretsCommand(ctx context.Context, secrets map[string]*string) error {\n\tfor name, value := range secrets {\n\t\tif value == nil {\n\t\t\terr := secretstore.DeleteSecret(name)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error deleting secret %q: %w\", name, err)\n\t\t\t}\n\t\t} else {\n\t\t\terr := secretstore.SetSecret(name, *value)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error setting secret %q: %w\", name, err)\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc (ws *WshServer) GetSecretsLinuxStorageBackendCommand(ctx context.Context) (string, error) {\n\tbackend, err := secretstore.GetLinuxStorageBackend()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"error getting linux storage backend: %w\", err)\n\t}\n\treturn backend, nil\n}","sourceCodeStart":1484,"sourceCodeEnd":1520,"githubUrl":"https://github.com/wavetermdev/waveterm/blob/a4447c1563b2df285ab89e76c82f91e1a1a49c1e/pkg/wshrpc/wshserver/wshserver.go#L1484-L1520","documentation":"SetSecretsCommand treats a nil value in the secrets map as a delete request and calls secretstore.DeleteSecret. Failure to delete is wrapped as \"error deleting secret %q\". Deletion can fail when the backend cannot remove the item or denies access to the collection.","triggerScenarios":"SetSecretsCommand with secrets map entry {name: nil} while the keychain is locked, the secret service is unavailable, or the item is write-protected in the backend.","commonSituations":"Bulk-clearing credentials over SSH on headless Linux (no keyring daemon); keychain ACLs preventing modification; backend file permissions read-only.","solutions":["Inspect the wrapped cause to see whether it is access denial or backend unavailability.","Unlock/start the OS keychain service and retry the delete.","On Linux, check the configured storage backend is writable (see GetSecretsLinuxStorageBackendCommand).","Retry the specific failing name; entries processed before the failure were already applied."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if runtime.GOOS == \"linux\" {\n    if _, err := wshclient.GetSecretsLinuxStorageBackendCommand(ctx); err != nil {\n        return fmt.Errorf(\"cannot delete secret, no writable backend: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := wshclient.SetSecretsCommand(ctx, map[string]*string{name: nil})\nif err != nil && strings.Contains(err.Error(), \"error deleting secret\") {\n    // keychain locked or item protected; surface to user and retry after unlock\n}","preventionTips":["Delete secrets one per call so a backend failure doesn't abort a whole batch nondeterministically.","Verify the keyring is unlocked before scripted deletions.","Check backend storage permissions if deletes consistently fail."],"tags":["secrets","keychain","rpc"],"backgroundTag":"keychain-write-failed","analyzedSha":"a4447c1563b2df285ab89e76c82f91e1a1a49c1e","analyzedAt":"2026-09-01T15:26:23.972Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}