pulumi/pulumi · error

parsing stack name: %w

Error message

parsing stack name: %w

What it means

The stack name stored in the service secrets manager state could not be parsed by tokens.ParseStackName. This error wraps that failure with %w. ParseStackName splits a fully qualified stack reference into project and stack parts and fails on malformed names.

Source

Thrown at pkg/secrets/service/manager.go:223

func NewServiceSecretsManagerFromState(ctx context.Context, state json.RawMessage) (secrets.Manager, error) {
	var s serviceSecretsManagerState
	if err := json.Unmarshal(state, &s); err != nil {
		return nil, fmt.Errorf("unmarshalling state: %w", err)
	}

	account, err := getServiceSecretsAccount(s.URL)
	if err != nil {
		return nil, fmt.Errorf("getting access token: %w", err)
	}
	token := account.AccessToken

	if token == "" {
		return nil, fmt.Errorf("could not find access token for %s, have you logged in?", s.URL)
	}

	stack, err := tokens.ParseStackName(s.Stack)
	if err != nil {
		return nil, fmt.Errorf("parsing stack name: %w", err)
	}

	id := client.StackIdentifier{
		Owner:   s.Owner,
		Project: s.Project,
		Stack:   stack,
	}
	c := client.NewClient(s.URL, token, s.Insecure, diag.DefaultSink(io.Discard, io.Discard, diag.FormatOptions{
		Color: colors.Never,
	}))

	crypter := newServiceCrypter(ctx, c, id)
	cachedCrypter := config.NewCiphertextToPlaintextCachedCrypter(crypter, crypter)
	return &serviceSecretsManager{
		state:   state,
		crypter: cachedCrypter,
	}, nil
}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Fix the `stack` field in the secrets provider state to a valid fully qualified name (e.g., "myproject/dev")
2. Restore the stack state from backup if it was corrupted
3. Check the wrapped error (%w detail) for the exact parsing rule violated
4. Re-create the stack's secrets provider if the state is unrecoverable: pulumi stack change-secrets-provider

Example fix

// before (state)
{"url":"https://app.pulumi.com","stack":"dev", ...}
// after
{"url":"https://app.pulumi.com","stack":"myproject/dev", ...}

_, err := tokens.ParseStackName(stateStack)
if err != nil {
    return fmt.Errorf("state holds invalid stack name %q: %w", stateStack, err)
}

func validQualifiedStackName(s string) bool {
    _, err := tokens.ParseStackName(s)
    return err == nil
}

mgr, err := secrets.NewServiceSecretsManagerFromState(ctx, state)
if err != nil && strings.Contains(err.Error(), "parsing stack name") {
    return fmt.Errorf("repair the stack field in secrets-provider state: %w", err)
}

When it happens

Trigger: NewServiceSecretsManagerFromState calling tokens.ParseStackName(s.Stack) when s.Stack from the persisted state is empty or not a valid <project>/<stack> (or org/project/stack) reference.

Common situations: Hand-edited or corrupted secrets-provider state, state migrated between backends with different naming conventions, legacy state containing a bare stack name without a project.

Related errors

• unmarshalling state: %w
• failed to serialize repaired snapshot: %w
• getting snapshot: %w
• could not create service secrets manager for stack %q: %w
• load stack snapshot: %w

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/20c354ffd1e212f2. Report an issue: GitHub.