wavetermdev/waveterm · error

setting secret: %w

Error message

setting secret: %w

What it means

This wraps any failure of the SetSecretsCommand RPC (2s timeout) that actually persists the secret after all local validation and backend checks passed. The daemon-side write into the secret manager failed — or the RPC could not complete at all — so the secret was not stored (or not confirmed stored).

Source

Thrown at cmd/wsh/cmd/wshcmd-secret.go:131

	value := parts[1]

	if name == "" {
		return fmt.Errorf("secret name cannot be empty")
	}

	backend, err := wshclient.GetSecretsLinuxStorageBackendCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("checking secret storage backend: %w", err)
	}

	if backend == "basic_text" || backend == "unknown" {
		return fmt.Errorf("No appropriate secret manager found, cannot set secrets")
	}

	secrets := map[string]*string{name: &value}
	err = wshclient.SetSecretsCommand(RpcClient, secrets, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("setting secret: %w", err)
	}

	WriteStdout("secret set: %s\n", name)
	return nil
}

func secretListRun(cmd *cobra.Command, args []string) (rtnErr error) {
	defer func() {
		sendActivity("secret", rtnErr == nil)
	}()

	names, err := wshclient.GetSecretsNamesCommand(RpcClient, &wshrpc.RpcOpts{Timeout: 2000})
	if err != nil {
		return fmt.Errorf("listing secrets: %w", err)
	}

	for _, name := range names {
		WriteStdout("%s\n", name)

View on GitHub (pinned to a4447c1563)

Solutions

1. Read the wrapped inner error: if it is a timeout, retry once after confirming the daemon is responsive (`wsh ls`).
2. Unlock/restart your OS keyring (gnome-keyring/kwallet) and ensure the user session's secret service is running, then retry the set.
3. Restart Wave Terminal to re-establish the RPC connection, then re-run the command.
4. Verify the secret was not partially written with `wsh secret get NAME` / `wsh secret list` and re-set it; update Wave/wsh to matching versions if server-side validation rejects the name.

// Pre-flight: confirm daemon reachable and keyring writable
// if err := exec.Command("wsh", "ls").Run(); err != nil { /* reconnect first */ }

err := wshclient.SetSecretsCommand(RpcClient, secrets, &wshrpc.RpcOpts{Timeout: 2000})
if err != nil {
    if errors.Is(err, ErrTimeout) {
        // retry once after confirming the daemon responds
    }
    return fmt.Errorf("setting secret: %w", err)
}

When it happens

Trigger: Running `wsh secret set NAME=VALUE` when the daemon is unreachable or the RPC times out (2000ms), when the OS keyring rejects or errors on the write (locked keyring, D-Bus failure, storage quota), or when the server rejects the name server-side despite client validation (version mismatch).

Common situations: Keyring locked after screen-lock/session timeout so writes fail; secret-service crashes mid-write; Wave daemon restarted between the backend check and the set; very slow keyring making the 2s timeout too tight; older daemon rejecting newer name rules.

Related errors

• checking secret storage backend: %w
• listing secrets: %w
• deleting secret: %w
• failed to list workspaces: %v
• failed to list blocks from all %d workspace(s)

AI-assisted analysis of wavetermdev/waveterm@a4447c1563 (2026-09-01). Data as JSON: /api/errors/fe382f7ee681d500. Report an issue: GitHub.