wavetermdev/waveterm · error

getting secret: %w

Error message

getting secret: %w

What it means

This error wraps any failure of the GetSecretsCommand RPC (2s timeout) issued by `wsh secret get`. It means the wsh client could not retrieve secrets from the Wave daemon — the request itself failed, as opposed to the secret simply not existing (which yields "secret not found"). Typical wrapped causes are the daemon not running/not connected, the route being unavailable, or the RPC timing out.

Source

Thrown at cmd/wsh/cmd/wshcmd-secret.go:90

	secretCmd.AddCommand(secretSetCmd)
	secretCmd.AddCommand(secretListCmd)
	secretCmd.AddCommand(secretDeleteCmd)
	secretCmd.AddCommand(secretUiCmd)
}

func secretGetRun(cmd *cobra.Command, args []string) (rtnErr error) {
	defer func() {
		sendActivity("secret", rtnErr == nil)
	}()

	name := args[0]
	if !secretNameRegex.MatchString(name) {
		return fmt.Errorf("invalid secret name: must start with a letter and contain only letters, numbers, and underscores")
	}

	resp, err := wshclient.GetSecretsCommand(RpcClient, []string{name}, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("getting secret: %w", err)
	}

	value, ok := resp[name]
	if !ok {
		return fmt.Errorf("secret not found: %s", name)
	}

	WriteStdout("%s\n", value)
	return nil
}

func secretSetRun(cmd *cobra.Command, args []string) (rtnErr error) {
	defer func() {
		sendActivity("secret", rtnErr == nil)
	}()

	parts := strings.SplitN(args[0], "=", 2)
	if len(parts) != 2 {

View on GitHub (pinned to a4447c1563)

Solutions

1. Ensure Wave Terminal (and its daemon) is running and reconnect: rerun the command from a Wave terminal or restart Wave.
2. Retry after checking general wsh connectivity (e.g. `wsh ls`); if it times out, investigate the wrapped error for timeout vs route-not-found.
3. If the wrapped error is a timeout, check for a hung secret manager (gnome-keyring, kwallet) on Linux that blocks the daemon's secret store.
4. Update both Wave Terminal and wsh to matching versions so the GetSecrets RPC exists on both sides.

// Check wsh/daemon connectivity first:
// err := exec.Command("wsh", "ls").Run(); if err != nil { /* daemon unreachable */ }

if err := secretGet(name); err != nil {
    var rpcErr *RPCError
    if errors.As(err, &rpcErr) && errors.Is(rpcErr, ErrTimeout) {
        // daemon slow or unreachable; check Wave is running, then retry once
    } else {
        return fmt.Errorf("getting secret: %w", err)
    }
}

When it happens

Trigger: Running `wsh secret get NAME` when no Wave Terminal daemon is reachable (Wave not running, stale connection), when the wshclient call exceeds the 2000ms RpcOpts timeout, or when the server-side GetSecrets handler returns an error (e.g. secret store access failure on Linux keyring issues).

Common situations: Running wsh from a plain SSH shell where the Wave daemon is not running; Wave app was restarted and the CLI connection is stale; slow system keyring (gnome-keyring/kwallet) blocking the daemon causing the 2s timeout; older wsh binary talking to a newer daemon without the secrets RPC.

Related errors

• failed to list workspaces: %v
• failed to list blocks from all %d workspace(s)
• running view command: %w
• writing file: %w
• listing secrets: %w

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/0660d7fe5ed62c23. Report an issue: GitHub.