wavetermdev/waveterm · error

failed to build secret environment (ERR-SECRET): %w

Error message

failed to build secret environment (ERR-SECRET): %w

What it means

runBuilderApp calls waveappstore.BuildAppSecretEnv(appId, manifest, secretBindings) to turn the manifest + bindings into environment variables. This ERR-SECRET error means a binding could not be resolved into an env value — e.g. a bound secret does not exist in the secrets store, or the manifest declares a binding inconsistent with stored bindings.

Source

Thrown at pkg/buildercontroller/buildercontroller.go:317

		}
		bc.lock.Unlock()
	}()
}

func (bc *BuilderController) runBuilderApp(ctx context.Context, appId string, appBinPath string, builderEnv map[string]string) (*BuilderProcess, error) {
	manifest, err := waveappstore.ReadAppManifest(appId)
	if err != nil {
		return nil, fmt.Errorf("failed to read app manifest: %w", err)
	}

	secretBindings, err := waveappstore.ReadAppSecretBindings(appId)
	if err != nil {
		return nil, fmt.Errorf("failed to read secret bindings (ERR-SECRET): %w", err)
	}

	secretEnv, err := waveappstore.BuildAppSecretEnv(appId, manifest, secretBindings)
	if err != nil {
		return nil, fmt.Errorf("failed to build secret environment (ERR-SECRET): %w", err)
	}

	if builderEnv == nil {
		builderEnv = make(map[string]string)
	}
	for k, v := range secretEnv {
		builderEnv[k] = v
	}

	cmd := exec.Command(appBinPath)
	cmd.Env = append(os.Environ(), "TSUNAMI_CLOSEONSTDIN=1")

	if wavebase.IsDevMode() {
		cmd.Env = append(cmd.Env, "TSUNAMI_CORS="+tsunamiutil.DevModeCorsOrigins)
	}

	for key, value := range builderEnv {
		cmd.Env = append(cmd.Env, key+"="+value)

View on GitHub (pinned to a4447c1563)

Solutions

1. Re-bind or re-create the missing secret in the secrets store
2. Compare manifest-declared bindings with stored bindings and remove stale ones
3. Re-provision secrets via the secrets UI so binding names match exactly
4. Check the app namespace used for lookup matches where secrets were stored

Example fix

// before
// binding "API_KEY" -> secret deleted
// after
waveappstore.SetAppSecret(appNS, "API_KEY", newValue) // then rebuild/restart the app

bindings, _ := waveappstore.ReadAppSecretBindings(appId)
for name := range bindings {
    if _, err := waveappstore.GetSecret(appNS, name); err != nil {
        return fmt.Errorf("missing secret %q bound to app", name)
    }
}

if err := runApp(appId); err != nil {
    if strings.Contains(err.Error(), "failed to build secret environment") {
        // re-bind or recreate the missing secret
    }
}

When it happens

Trigger: BuildAppSecretEnv fails — binding references a secret name not present in the store, a secret value was deleted after being bound, or manifest/binding schema mismatch.

Common situations: Secret deleted from the store while still bound to the app; user edited the app manifest adding a binding without provisioning the secret; namespace mismatch between binding and secret store.

Related errors

• setting auth key: %v
• No appropriate secret manager found, cannot set secrets
• electron executable path not set
• failed to read secret bindings (ERR-SECRET): %w
• error expanding home dir: %w

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/ca509e8dbfba0c7a. Report an issue: GitHub.