TencentCloud/TencentDB-Agent-Memory · error

Invalid scrypt parameter: ${raw}

Error message

Invalid scrypt parameter: ${raw}

What it means

parsePositiveInt validates SCRYPT_N/R/P env values and the derived keylen before they reach the scrypt KDF. It throws when a raw env string is non-empty but is not a finite positive integer (e.g. 'abc', '0', '2.5', '-1'), because invalid scrypt cost parameters would either crash the KDF or weaken hashing. The fallback is only used when the variable is unset/blank.

Source

Thrown at MemoryCore/src/metadata/utils/crypto.ts:87

  if (pepper.length !== PEPPER_LEN) {
    throw new Error(
      `TDAI_PASSWORD_PEPPER must decode to ${PEPPER_LEN} bytes, got ${pepper.length}`,
    );
  }

  const scryptN = parsePositiveInt(env.TDAI_PASSWORD_SCRYPT_N, DEFAULT_SCRYPT_N);
  const scryptR = parsePositiveInt(env.TDAI_PASSWORD_SCRYPT_R, DEFAULT_SCRYPT_R);
  const scryptP = parsePositiveInt(env.TDAI_PASSWORD_SCRYPT_P, DEFAULT_SCRYPT_P);
  const keylen = parsePositiveInt(env.TDAI_PASSWORD_SCRYPT_KEYLEN, DEFAULT_SCRYPT_KEYLEN);

  return { pepper, scryptN, scryptR, scryptP, keylen };
}

function parsePositiveInt(raw: string | undefined, fallback: number): number {
  if (!raw?.trim()) return fallback;
  const n = Number(raw);
  if (!Number.isFinite(n) || n <= 0 || !Number.isInteger(n)) {
    throw new Error(`Invalid scrypt parameter: ${raw}`);
  }
  return n;
}

function scryptHash(plain: string, salt: Buffer, config: PasswordHashConfig): Buffer {
  const input = Buffer.concat([config.pepper, Buffer.from(plain, "utf8")]);
  return scryptSync(input, salt, config.keylen, {
    N: config.scryptN,
    r: config.scryptR,
    p: config.scryptP,
  });
}

/**
 * 对明文密码做 scrypt+pepper 哈希，返回自描述存库串。
 *
 * 格式：`$scrypt$N,r,p$<salt_b64>$<hash_b64>`
 */

View on GitHub (pinned to 3efcd317b8)

Solutions

1. Fix the env variable to a positive integer string, e.g. SCRYPT_N=16384, SCRYPT_R=8, SCRYPT_P=1
2. Remove the variable entirely to use the built-in fallback value
3. Trim whitespace/quotes from the .env entry (Number() rejects stray quotes and units like '16k')
4. Add startup validation that logs parsed scrypt params before hashing begins

Example fix

// before (.env)
SCRYPT_N=16,384
// after (.env)
SCRYPT_N=16384

function validScryptEnv(v?: string) { if (!v?.trim()) return true; const n = Number(v); return Number.isFinite(n) && n > 0 && Number.isInteger(n); }
if (!validScryptEnv(process.env.SCRYPT_N) || !validScryptEnv(process.env.SCRYPT_R) || !validScryptEnv(process.env.SCRYPT_P)) throw new Error('SCRYPT_N/R/P must be positive integers');

const isPositiveIntString = (v: string | undefined): v is string => !!v?.trim() && Number.isInteger(Number(v)) && Number(v) > 0;

try { cfg = { n: scryptN(), r: scryptR(), p: scryptP() }; } catch (e) { logger.warn(`bad scrypt env: ${e.message}; using fallbacks`); cfg = defaultScryptConfig; }

When it happens

Trigger: Calling scryptN, scryptR, scryptP or keylen with an env var like SCRYPT_N set to a non-integer or non-positive string; e.g. SCRYPT_R='0.5' or SCRYPT_P='abc'.

Common situations: Typo in env config ('SCRYPT_N=16_000' — underscores not parsed), quoting errors leaving stray characters, YAML/JSON values pasted into .env, or someone setting 0 or a negative value to 'disable' the parameter.

Related errors

• redis config is required when state_backend=redis
• [state-backend] Redis integration is not available — install
• invalid_param_value
• unknown_module
• invalid_param_scope

AI-assisted analysis of TencentCloud/TencentDB-Agent-Memory@3efcd317b8 (2026-09-01). Data as JSON: /api/errors/29b63d4654063c0a. Report an issue: GitHub.