wavetermdev/waveterm · error

failed to authenticate to server: %w

Error message

failed to authenticate to server: %w

What it means

The job manager client failed to authenticate itself to the main server over the control route. It sends an AuthenticateJobManagerCommand RPC with jobId and jobAuthToken; if that RPC errors (rejection, routing failure, wrong token), the error is logged and wrapped. Self-authentication gates subsequent privileged commands.

Source

Thrown at pkg/jobmanager/mainserverconn.go:62

func (rds *routedDataSender) SendData(dataPk wshrpc.CommandStreamData) {
	// log.Printf("SendData: sending seq=%d, len=%d, eof=%t, error=%s, route=%s",
	// 	dataPk.Seq, len(dataPk.Data64), dataPk.Eof, dataPk.Error, rds.route)
	err := wshclient.StreamDataCommand(rds.wshRpc, dataPk, &wshrpc.RpcOpts{NoResponse: true, Route: rds.route})
	if err != nil {
		log.Printf("SendData: error sending stream data: %v\n", err)
	}
}

func (msc *MainServerConn) authenticateSelfToServer(jobAuthToken string) error {
	jobId, _ := WshCmdJobManager.GetJobAuthInfo()
	authData := wshrpc.CommandAuthenticateJobManagerData{
		JobId:        jobId,
		JobAuthToken: jobAuthToken,
	}
	err := wshclient.AuthenticateJobManagerCommand(msc.WshRpc, authData, &wshrpc.RpcOpts{Route: wshutil.ControlRoute})
	if err != nil {
		log.Printf("authenticateSelfToServer: failed to authenticate to server: %v\n", err)
		return fmt.Errorf("failed to authenticate to server: %w", err)
	}
	msc.SelfAuthenticated.Store(true)
	log.Printf("authenticateSelfToServer: successfully authenticated to server\n")
	return nil
}

func (msc *MainServerConn) AuthenticateToJobManagerCommand(ctx context.Context, data wshrpc.CommandAuthenticateToJobData) error {
	jobId, jobAuthToken := WshCmdJobManager.GetJobAuthInfo()

	claims, err := wavejwt.ValidateAndExtract(data.JobAccessToken)
	if err != nil {
		log.Printf("AuthenticateToJobManager: failed to validate token: %v\n", err)
		return fmt.Errorf("failed to validate token: %w", err)
	}
	if !claims.MainServer {
		log.Printf("AuthenticateToJobManager: MainServer claim not set\n")
		return fmt.Errorf("MainServer claim not set")
	}

View on GitHub (pinned to a4447c1563)

Solutions

1. Verify the jobAuthToken is current and matches the job's registered token; re-obtain it via the job creation flow.
2. Check that jobId matches the one the server knows; restart the job connection to refresh auth info.
3. Inspect the wrapped inner error for RPC-level causes (timeout, route not found) and fix connectivity.

Example fix

// before
err := msc.authenticateSelfToServer(jobAuthToken)
// after
if err := msc.authenticateSelfToServer(jobAuthToken); err != nil {
    // refresh token and retry once
    jobId, jobAuthToken = WshCmdJobManager.GetJobAuthInfo()
    err = msc.authenticateSelfToServer(jobAuthToken)
    if err != nil {
        return fmt.Errorf("job manager auth failed: %w", err)
    }
}

jobId, jobAuthToken := WshCmdJobManager.GetJobAuthInfo()
if jobAuthToken == "" {
    return fmt.Errorf("no job auth token available; cannot authenticate")
}

err := msc.authenticateSelfToServer(jobAuthToken)
if err != nil {
    // one retry after refreshing auth info
    _, jobAuthToken = WshCmdJobManager.GetJobAuthInfo()
    if retryErr := msc.authenticateSelfToServer(jobAuthToken); retryErr != nil {
        return fmt.Errorf("job manager auth failed: %w", retryErr)
    }
}

When it happens

Trigger: authenticateSelfToServer() called from AuthenticateToJobManagerCommand when the AuthenticateJobManagerCommand RPC returns an error — server rejects the job auth token, the RPC times out, or the control route is unreachable.

Common situations: Expired or wrong jobAuthToken, jobId mismatch between client and server, server not running the job-manager handlers, or WSH routing problems in the blockfile/shell environment.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• error authenticating with upstream: %v
• JobId mismatch
• not authenticated
• peer not authenticated
• not authenticated to server

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/d999b20b6104055b. Report an issue: GitHub.