wavetermdev/waveterm · error

checking secret storage backend: %w

Error message

checking secret storage backend: %w

What it means

This wraps any failure of the GetSecretsLinuxStorageBackendCommand RPC, which asks the daemon which secret storage backend Linux is using. The command checks the backend before setting a secret so it can refuse early if storage is inadequate; if this pre-check RPC itself fails (unreachable daemon, timeout, or handler error), the whole set operation aborts with this wrapped error.

Source

Thrown at cmd/wsh/cmd/wshcmd-secret.go:121

	defer func() {
		sendActivity("secret", rtnErr == nil)
	}()

	parts := strings.SplitN(args[0], "=", 2)
	if len(parts) != 2 {
		return fmt.Errorf("invalid format: expected [name]=[value]")
	}

	name := parts[0]
	value := parts[1]

	if name == "" {
		return fmt.Errorf("secret name cannot be empty")
	}

	backend, err := wshclient.GetSecretsLinuxStorageBackendCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("checking secret storage backend: %w", err)
	}

	if backend == "basic_text" || backend == "unknown" {
		return fmt.Errorf("No appropriate secret manager found, cannot set secrets")
	}

	secrets := map[string]*string{name: &value}
	err = wshclient.SetSecretsCommand(RpcClient, secrets, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("setting secret: %w", err)
	}

	WriteStdout("secret set: %s\n", name)
	return nil
}

func secretListRun(cmd *cobra.Command, args []string) (rtnErr error) {
	defer func() {

View on GitHub (pinned to a4447c1563)

Solutions

1. Ensure the Wave daemon is running and reachable (retry from a Wave terminal; restart Wave if the connection is stale).
2. On Linux, verify a secret service is available: check `busctl --user` / that gnome-keyring or KWallet is running; install/run one if on a headless box.
3. If the wrapped error is a timeout, look for a hung keyring/D-Bus daemon blocking the backend probe and restart it.
4. Update Wave Terminal and wsh to matching versions so the backend RPC exists on both ends.

// Pre-check reachability before set:
// if err := exec.Command("wsh", "ls").Run(); err != nil { /* fix daemon connection first */ }

backend, err := wshclient.GetSecretsLinuxStorageBackendCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})
if err != nil {
    if errors.Is(err, ErrTimeout) {
        // daemon hung or unreachable; restart Wave and check keyring service
    }
    return fmt.Errorf("checking secret storage backend: %w", err)
}

When it happens

Trigger: Running `wsh secret set NAME=VALUE` on Linux when the daemon is unreachable or times out (2000ms RpcOpts timeout), or the server-side backend-detection handler errors (e.g. failure probing gnome-keyring/kwallet/secret-service via D-Bus).

Common situations: Linux headless servers or WSL without a keyring service running (no D-Bus / secret-service), so backend probing fails; stale wsh connection after Wave restart; daemon busy on a hung keyring call causing the timeout.

Related errors

• setting secret: %w
• failed to list workspaces: %v
• failed to list blocks from all %d workspace(s)
• reinstalling connection: %w
• disconnecting %q error: %w

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/0b387d07d4051549. Report an issue: GitHub.