What causes "not authenticated to server" in wavetermdev/waveterm?

Ensure authenticateSelfToServer ran and succeeded; check its logs for 'failed to authenticate to server'.

not authenticated to server

Error message

not authenticated to server

What it means

Second check in JobPrepareConnectCommand: the peer is authenticated, but this job manager process itself has not yet authenticated to the main server (SelfAuthenticated false, set only after authenticateSelfToServer succeeds). The connection is not fully two-way authenticated, so PrepareConnect is refused.

Source

Thrown at pkg/jobmanager/mainserverconn.go:112

	WshCmdJobManager.SetAttachedClient(msc)
	return nil
}

func (msc *MainServerConn) StartJobCommand(ctx context.Context, data wshrpc.CommandStartJobData) (*wshrpc.CommandStartJobRtnData, error) {
	log.Printf("StartJobCommand: received command=%s args=%v", data.Cmd, data.Args)
	if !msc.PeerAuthenticated.Load() {
		log.Printf("StartJobCommand: not authenticated")
		return nil, fmt.Errorf("not authenticated")
	}
	return WshCmdJobManager.StartJob(msc, data)
}

func (msc *MainServerConn) JobPrepareConnectCommand(ctx context.Context, data wshrpc.CommandJobPrepareConnectData) (*wshrpc.CommandJobConnectRtnData, error) {
	if !msc.PeerAuthenticated.Load() {
		return nil, fmt.Errorf("peer not authenticated")
	}
	if !msc.SelfAuthenticated.Load() {
		return nil, fmt.Errorf("not authenticated to server")
	}
	return WshCmdJobManager.PrepareConnect(msc, data)
}

func (msc *MainServerConn) JobStartStreamCommand(ctx context.Context, data wshrpc.CommandJobStartStreamData) error {
	if !msc.PeerAuthenticated.Load() {
		return fmt.Errorf("not authenticated")
	}
	return WshCmdJobManager.StartStream(msc)
}

func (msc *MainServerConn) JobInputCommand(ctx context.Context, data wshrpc.CommandJobInputData) error {
	if !msc.PeerAuthenticated.Load() {
		return fmt.Errorf("not authenticated")
	}
	if !WshCmdJobManager.IsJobStarted() {
		return fmt.Errorf("job not started")
	}

View on GitHub (pinned to a4447c1563)

Solutions

Ensure authenticateSelfToServer ran and succeeded; check its logs for 'failed to authenticate to server'.
Retry the full AuthenticateToJobManagerCommand flow, which performs both peer and self authentication.
Fix underlying self-auth causes (jobAuthToken validity, server reachability) then reconnect.

Example fix

// before
// peer auth done, self auth skipped/failed
conn.JobPrepareConnectCommand(ctx, prepData)
// after
if err := msc.authenticateSelfToServer(jobAuthToken); err != nil {
    return fmt.Errorf("self auth required before PrepareConnect: %w", err)
}
rtn, err := conn.JobPrepareConnectCommand(ctx, prepData)

Defensive patterns

Strategy: try-catch

Validate before calling

if !conn.selfAuthenticated() {
    return fmt.Errorf("self-auth to server incomplete; rerun the auth handshake")
}

Try / catch

rtn, err := conn.JobPrepareConnectCommand(ctx, data)
if err != nil {
    if err.Error() == "not authenticated to server" {
        if authErr := conn.AuthenticateToJobManagerCommand(ctx, authData); authErr != nil {
            return fmt.Errorf("self auth failed: %w", authErr)
        }
        rtn, err = conn.JobPrepareConnectCommand(ctx, data)
    }
    if err != nil { return err }
}

Prevention

Always use the full AuthenticateToJobManagerCommand flow (it does both peer and self auth)
Verify self-auth logs after transient network failures and retry
Treat half-completed handshakes as failed and restart the sequence

When it happens

Trigger: JobPrepareConnectCommand called when PeerAuthenticated is true but SelfAuthenticated is false — e.g. authenticateSelfToServer failed or was never invoked during the handshake.

Common situations: Peer auth succeeded but the self-auth RPC to the server errored (network, wrong jobAuthToken), or a partially completed handshake after a transient failure.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/43057ffd7bb422e5. Report an issue: GitHub.