wavetermdev/waveterm · error

checking secret storage backend

Error message

checking secret storage backend: %w

What it means

This wraps any failure of the GetSecretsLinuxStorageBackendCommand RPC, which asks the daemon which secret storage backend Linux is using. The command checks the backend before setting a secret so it can refuse early if storage is inadequate; if this pre-check RPC itself fails (unreachable daemon, timeout, or handler error), the whole set operation aborts with this wrapped error.

Solutions

1. Ensure the Wave daemon is running and reachable (retry from a Wave terminal; restart Wave if the connection is stale).
2. On Linux, verify a secret service is available: check `busctl --user` / that gnome-keyring or KWallet is running; install/run one if on a headless box.
3. If the wrapped error is a timeout, look for a hung keyring/D-Bus daemon blocking the backend probe and restart it.
4. Update Wave Terminal and wsh to matching versions so the backend RPC exists on both ends.

// Pre-check reachability before set:
// if err := exec.Command("wsh", "ls").Run(); err != nil { /* fix daemon connection first */ }

backend, err := wshclient.GetSecretsLinuxStorageBackendCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})
if err != nil {
    if errors.Is(err, ErrTimeout) {
        // daemon hung or unreachable; restart Wave and check keyring service
    }
    return fmt.Errorf("checking secret storage backend: %w", err)
}

When it happens

Trigger: Running `wsh secret set NAME=VALUE` on Linux when the daemon is unreachable or times out (2000ms RpcOpts timeout), or the server-side backend-detection handler errors (e.g. failure probing gnome-keyring/kwallet/secret-service via D-Bus).

Common situations: Linux headless servers or WSL without a keyring service running (no D-Bus / secret-service), so backend probing fails; stale wsh connection after Wave restart; daemon busy on a hung keyring call causing the timeout.

Related errors

• setting secret
• deleting secret
• disconnecting error
• EC-TIME: timeout waiting for response
• ensuring connection

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/0b387d07d4051549. Report an issue: GitHub.

Appendix: source

Thrown at cmd/wsh/cmd/wshcmd-secret.go:121

	defer func() {
		sendActivity("secret", rtnErr == nil)
	}()

	parts := strings.SplitN(args[0], "=", 2)
	if len(parts) != 2 {
		return fmt.Errorf("invalid format: expected [name]=[value]")
	}

	name := parts[0]
	value := parts[1]

	if name == "" {
		return fmt.Errorf("secret name cannot be empty")
	}

	backend, err := wshclient.GetSecretsLinuxStorageBackendCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("checking secret storage backend: %w", err)
	}

	if backend == "basic_text" || backend == "unknown" {
		return fmt.Errorf("No appropriate secret manager found, cannot set secrets")
	}

	secrets := map[string]*string{name: &value}
	err = wshclient.SetSecretsCommand(RpcClient, secrets, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("setting secret: %w", err)
	}

	WriteStdout("secret set: %s\n", name)
	return nil
}

func secretListRun(cmd *cobra.Command, args []string) (rtnErr error) {
	defer func() {

View on GitHub (pinned to a4447c1563)