{"record":{"id":"3a804aadad1968f4","repo":"zeroclaw-labs/zeroclaw","slug":"computer-use-sidecar-returned-a-non-png-screenshot","errorCode":null,"errorMessage":"computer-use sidecar returned a non-PNG screenshot payload","messagePattern":"computer-use sidecar returned a non-PNG screenshot payload","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/browser.rs","lineNumber":1174,"sourceCode":"                        })?;\n\n                    // Decode and validate the PNG payload: it must decode to a\n                    // non-empty buffer with a PNG signature. Base64-decodable\n                    // arbitrary bytes are NOT a valid screenshot — writing them\n                    // to the `.png` destination would turn the sidecar boundary\n                    // into an arbitrary decoded-byte write.\n                    let png_bytes = base64::engine::general_purpose::STANDARD\n                        .decode(png_data)\n                        .with_context(|| \"Failed to decode PNG base64 data\")?;\n                    if png_bytes.is_empty() {\n                        anyhow::bail!(crate::i18n::get_required_tool_string(\n                            \"tool-browser-screenshot-error-sidecar-empty-png\",\n                        ));\n                    }\n                    const PNG_SIGNATURE: &[u8] =\n                        &[0x89, b'P', b'N', b'G', b'\\r', b'\\n', 0x1a, b'\\n'];\n                    if !png_bytes.starts_with(PNG_SIGNATURE) {\n                        anyhow::bail!(crate::i18n::get_required_tool_string(\n                            \"tool-browser-screenshot-error-sidecar-not-png\",\n                        ));\n                    }\n\n                    tokio::fs::write(path_str, &png_bytes)\n                        .await\n                        .with_context(|| format!(\"Failed to write screenshot to {path_str}\"))?;\n\n                    // Return success with the path information\n                    let output = serde_json::to_string_pretty(&json!({\n                        \"backend\": \"computer_use\",\n                        \"action\": action,\n                        \"path\": path_str,\n                        \"bytes\": png_bytes.len(),\n                    }))\n                    .unwrap_or_default();\n\n                    return Ok(ToolResult {","sourceCodeStart":1156,"sourceCodeEnd":1192,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/browser.rs#L1156-L1192","documentation":"Decoded sidecar payloads must start with the PNG magic signature (89 50 4E 47 0D 0A 1A 0A). Base64-decodable arbitrary bytes are not a valid screenshot, and writing them to the .png destination would turn the sidecar boundary into an arbitrary decoded-byte write, so anything non-PNG (JPEG, WebP, error text) is rejected before tokio::fs::write runs.","triggerScenarios":"The sidecar is configured to return JPEG/WebP screenshots, or stuffs a JSON error blob into png_base64, while the tool call carries a destination path.","commonSituations":"Screenshot services that default to JPEG output; older sidecar versions with a different response envelope; misrouted sidecar endpoints answering with HTML/text that happens to be base64-encoded.","solutions":["Configure the sidecar to emit PNG — the contract is PNG-only","Upgrade the sidecar to a version matching the ComputerUseResponse contract","Capture the sidecar's raw response in a debug run to confirm which bytes are actually arriving"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match tool.execute(args).await {\n    Ok(res) if res.success => { /* file written */ }\n    Ok(res) => {\n        if res.error.as_deref().unwrap_or_default().contains(\"non-PNG\") {\n            // sidecar emitted a non-PNG image; fix its output format config\n        }\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Verify the sidecar emits PNG (not JPEG/WebP) in its configuration","Contract-test the sidecar response shape (data.png_base64) in CI","Do not write sidecar bytes to disk yourself — let the tool validate the signature"],"tags":["computer-use","sidecar","png","screenshot","payload-validation"],"backgroundTag":"invalid-image-format","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}