TencentCloud/TencentDB-Agent-Memory · error

Invalid generation log key

Error message

Invalid generation log key

What it means

MemoryGenerationLogStore.write validates the object key before uploading a generation log: it must start with the expected ROOT prefix, must not contain "..", and must not be absolute (start with "/"). This prevents writing logs outside the intended prefix (path traversal / namespace escape). A non-conforming key throws "Invalid generation log key".

Source

Thrown at MemoryCore/src/core/memory-generation-log/store.ts:104

    finished_at_ms: Number(match[5]),
    size,
    key,
  };
}

export class MemoryGenerationLogStore {
  private readonly storage: StorageAdapter;

  constructor(storage: StorageAdapter, private readonly instanceId: string) {
    const safeInstance = safeId(instanceId);
    this.storage = storage.type === "local"
      ? createScopedStorageAdapter(storage, `instances/${safeInstance}`)
      : storage;
  }

  async write(log: MemoryGenerationLog, key: string): Promise<void> {
    if (!key.startsWith(`${ROOT}/`) || key.includes("..") || key.startsWith("/")) {
      throw new Error("Invalid generation log key");
    }
    await this.storage.getBackend().putObject(key, JSON.stringify(log), {
      contentType: "application/json",
      metadata: {
        log_id: log.log_id,
        layer: log.layer,
        status: log.status,
        instance_id: this.instanceId,
      },
      tags: {
        "tdai-log-type": "memory-generation",
      },
    });
  }

  async getByKey(key: string): Promise<MemoryGenerationLog | null> {
    if (!key.startsWith(`${ROOT}/`) || key.includes("..") || key.startsWith("/")) return null;
    const raw = await this.storage.readFile(key);

View on GitHub (pinned to 3efcd317b8)

Solutions

1. Always obtain the key from buildGenerationLogIdentity (or the identities returned by the store) rather than constructing it manually
2. Inspect the failing key: it must start with the ROOT prefix, contain no "..", and not begin with "/"
3. If migrating keys from an older version, regenerate them instead of reusing stored keys
4. Check whether an instance-scoped store (createScopedStorageAdapter) is double-prefixing — pass the unscoped key

Example fix

// before
await store.write(log, `/genlogs/layer=l1/x.json`);
// after
const { key } = buildGenerationLogIdentity({ layer: "l1", status: "ok", finishedAtMs: Date.now(), anchorMemoryId });
await store.write(log, key);

function isValidLogKey(key, root) {
  return typeof key === "string" && key.startsWith(`${root}/`) && !key.includes("..") && !key.startsWith("/");
}

function isStoreProducedKey(key, root) {
  return typeof key === "string" && key.startsWith(`${root}/`) && !key.includes("..") && !key.startsWith("/");
}

try {
  await store.write(log, key);
} catch (e) {
  if (e.message === "Invalid generation log key") {
    logger.error(`log key rejected: ${key.slice(0, 60)}...; regenerate with buildGenerationLogIdentity`);
  }
  throw e;
}

When it happens

Trigger: Calling write(log, key) with a key that was not produced by buildGenerationLogIdentity: missing the `${ROOT}/` prefix, containing ".." segments, or starting with "/"; also happens when a caller hand-builds keys or passes a full URL/absolute path instead of the relative key.

Common situations: Caller persisted a key with a different ROOT (ROOT changed across versions) and replays it; manual key construction in scripts; storage instance scoped to instances/<id> while the key is already instance-prefixed causing mismatch; deserialized/parsed keys altered in transit.

Related errors

• Generation log object key exceeds COS limit
• Path traversal rejected in scoped storage key: ${key}
• Storage key must be relative, got absolute: ${key}
• Path traversal rejected: key "${key}" escapes rootDir
• Invalid generation log cursor

AI-assisted analysis of TencentCloud/TencentDB-Agent-Memory@3efcd317b8 (2026-09-01). Data as JSON: /api/errors/7dafdcf0241c4c7b. Report an issue: GitHub.