wavetermdev/waveterm · error

failed to generate job auth token: %w

Error message

failed to generate job auth token: %w

What it means

StartJob generates a 32-byte random hex auth token (utilfn.RandomHexString) for the new job; if the CSPRNG read fails, the error is wrapped with this message. This almost never happens on healthy systems and usually signals OS-level entropy/RNG failure.

Source

Thrown at pkg/jobcontroller/jobcontroller.go:638

	if params.Cmd == "" {
		return "", fmt.Errorf("command is required")
	}
	if params.TermSize == nil {
		params.TermSize = &waveobj.TermSize{Rows: 24, Cols: 80}
	}

	isConnected, err := conncontroller.IsConnected(params.ConnName)
	if err != nil {
		return "", fmt.Errorf("error checking connection status: %w", err)
	}
	if !isConnected {
		return "", fmt.Errorf("connection %q is not connected", params.ConnName)
	}

	jobId := uuid.New().String()
	jobAuthToken, err := utilfn.RandomHexString(32)
	if err != nil {
		return "", fmt.Errorf("failed to generate job auth token: %w", err)
	}

	jobAccessClaims := &wavejwt.WaveJwtClaims{
		MainServer: true,
		JobId:      jobId,
	}
	jobAccessToken, err := wavejwt.Sign(jobAccessClaims)
	if err != nil {
		return "", fmt.Errorf("failed to generate job access token: %w", err)
	}

	job := &waveobj.Job{
		OID:              jobId,
		Connection:       params.ConnName,
		JobKind:          params.JobKind,
		Cmd:              params.Cmd,
		CmdArgs:          params.Args,
		CmdEnv:           params.Env,

View on GitHub (pinned to a4447c1563)

Solutions

1. Retry the StartJob call — the failure is typically transient or environmental.
2. Inspect the wrapped cause (%w) to identify the OS-level RNG failure.
3. Fix the host environment (restore /dev/urandom access, unblock getrandom seccomp rule) if it persists.

jobId, err := jobcontroller.StartJob(ctx, params)
if err != nil && strings.Contains(err.Error(), "failed to generate job auth token") {
    // transient OS RNG issue: retry once
    jobId, err = jobcontroller.StartJob(ctx, params)
}

When it happens

Trigger: utilfn.RandomHexString(32) returns an error from the underlying crypto/rand read — e.g. exhausted or inaccessible system entropy source.

Common situations: Container with restricted syscalls blocking getrandom, corrupted crypto runtime, extreme resource exhaustion.

Related errors

• error generating random string: %w
• setting auth key: %v
• error setting jwt public key: %v
• no WAVETERM_TABID env var set
• no WAVETERM_TABID env var set

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/98cc2bff54e4927a. Report an issue: GitHub.