What causes "secret name cannot be empty" in wavetermdev/waveterm?

Supply a valid name: `wsh secret set mykey=myvalue`.

secret name cannot be empty

Error message

secret name cannot be empty

What it means

After splitting the NAME=VALUE argument, `wsh secret set` explicitly rejects an empty name portion. This guards against inputs like "=value" or "=", which would otherwise create a nameless secret entry. The value may legitimately be empty, but the name may not.

Source

Thrown at cmd/wsh/cmd/wshcmd-secret.go:116

	WriteStdout("%s\n", value)
	return nil
}

func secretSetRun(cmd *cobra.Command, args []string) (rtnErr error) {
	defer func() {
		sendActivity("secret", rtnErr == nil)
	}()

	parts := strings.SplitN(args[0], "=", 2)
	if len(parts) != 2 {
		return fmt.Errorf("invalid format: expected [name]=[value]")
	}

	name := parts[0]
	value := parts[1]

	if name == "" {
		return fmt.Errorf("secret name cannot be empty")
	}

	backend, err := wshclient.GetSecretsLinuxStorageBackendCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("checking secret storage backend: %w", err)
	}

	if backend == "basic_text" || backend == "unknown" {
		return fmt.Errorf("No appropriate secret manager found, cannot set secrets")
	}

	secrets := map[string]*string{name: &value}
	err = wshclient.SetSecretsCommand(RpcClient, secrets, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("setting secret: %w", err)
	}

	WriteStdout("secret set: %s\n", name)

View on GitHub (pinned to a4447c1563)

Solutions

Supply a valid name: `wsh secret set mykey=myvalue`.
Check the variable holding the key name is non-empty before invoking: `[ -n "$KEY" ] || exit 1` or use `set -u` in shell scripts.
Trim whitespace/newlines from the key variable (e.g. KEY=$(echo "$KEY" | tr -d '[:space:]')) since stray whitespace can produce unexpected names.
Enable shell strict mode (`set -euo pipefail`) so unset KEY variables fail the script before reaching wsh.

Example fix

// before
wsh secret set "$KEY=$VALUE"   # KEY empty -> '=value'
// after
: "${KEY:?KEY must be set}"
wsh secret set "${KEY}=${VALUE}"

Defensive patterns

Strategy: validation

Validate before calling

name, value, found := strings.Cut(arg, "=")
if !found || strings.TrimSpace(name) == "" {
    return fmt.Errorf("secret name cannot be empty in %q", arg)
}

Prevention

Use set -u / ${KEY:?} guards so unset variables fail before invoking wsh
Trim whitespace from variables that hold key names
Validate the split parts in wrapper scripts before calling wsh
Never interpolate possibly-empty variables unquoted into the argument

When it happens

Trigger: Running `wsh secret set =myvalue` or `wsh secret set "="` — usually the result of an unquoted/empty shell variable interpolated into the argument: `wsh secret set "$KEY=$VAL"` where $KEY is unset.

Common situations: CI/shell scripts with unset environment variables (set -u not enabled); loops reading key=value pairs where blank lines produce empty keys; mis-templated config generation.

Related errors

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/c0eb5978f5fccdf8. Report an issue: GitHub.