tinyhumansai/openhuman · error

unknown secret ref {}

Error message

unknown secret ref {}

What it means

resolve_refs hit a SecretRef that is absent from the in-memory pending-secret map — the OAuth/credential flow that was supposed to store it never completed or was cleared. Deliberately an Err so callers do not partially apply secrets.

Source

Thrown at src/openhuman/mcp/registry/setup.rs:182

        }
    }
}

/// Resolve a `{KEY: SecretRef}` map into a `Vec<(KEY, VALUE)>`. Returns
/// `Err(_)` if any ref is unknown or not yet fulfilled — callers should
/// retry rather than partially-apply.
///
/// Touches the `last_touched` on every hit so iterative `test_connection`
/// calls reset the idle TTL.
pub async fn resolve_refs(
    refs: &HashMap<String, SecretRef>,
) -> anyhow::Result<Vec<(String, String)>> {
    let mut guard = map().lock().await;
    let mut out = Vec::with_capacity(refs.len());
    for (key, r) in refs {
        let entry = guard
            .get_mut(r)
            .ok_or_else(|| anyhow::anyhow!("unknown secret ref {}", r.as_str()))?;
        let value = entry
            .value
            .clone()
            .ok_or_else(|| anyhow::anyhow!("secret ref {} not yet fulfilled", r.as_str()))?;
        entry.last_touched = Instant::now();
        out.push((key.clone(), value));
    }
    Ok(out)
}

/// Same as [`resolve_refs`] but also removes the entries from the map on
/// success. Used by `install_and_connect` once the values have been
/// persisted to `mcp_client_env`. On failure the entries are left intact
/// so the agent can retry without re-prompting.
pub async fn consume_refs(
    refs: &HashMap<String, SecretRef>,
) -> anyhow::Result<Vec<(String, String)>> {
    // First pass: resolve. Bail without mutation if any ref is missing.

View on GitHub (pinned to 7491200858)

Solutions

1. Re-run the credential/OAuth flow that fulfils this secret ref
2. Check for TTL expiry that evicted the entry from the pending map
3. Verify the ref key matches the one issued at request time

When it happens

Trigger: Thrown at src/openhuman/mcp/registry/setup.rs:182 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tinyhumansai/openhuman@7491200858 (2026-08-17). Data as JSON: /api/errors/308c50b282474a11. Report an issue: GitHub.