{"record":{"id":"4671c3cb705d2e24","repo":"CherryHQ/cherry-studio","slug":"invalid-args-argument-at-index-index-must-be-a","errorCode":null,"errorMessage":"Invalid args: argument at index ${index} must be a string","messagePattern":"Invalid args: argument at index (.+?) must be a string","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/ai/mcp/McpPackageService.ts","lineNumber":179,"sourceCode":"  return trimmed\n}\n\n/**\n * Validate command arguments to prevent injection attacks.\n * Rejects arguments containing path traversal sequences.\n *\n * @param args - The arguments array to validate\n * @returns The validated arguments array\n * @throws Error if any argument contains path traversal\n */\nexport function validateArgs(args: string[]): string[] {\n  if (!Array.isArray(args)) {\n    throw new Error('Invalid args: must be an array')\n  }\n\n  return args.map((arg, index) => {\n    if (typeof arg !== 'string') {\n      throw new Error(`Invalid args: argument at index ${index} must be a string`)\n    }\n\n    // Check for null bytes\n    if (arg.includes('\\0')) {\n      throw new Error(`Invalid args: null byte detected in argument at index ${index}`)\n    }\n\n    // Check for path traversal in arguments that look like paths\n    // Only validate if the arg contains path separators (indicating it's meant to be a path)\n    if ((arg.includes('/') || arg.includes('\\\\')) && /(?:^|[/\\\\])\\.\\.(?:[/\\\\]|$)/.test(arg)) {\n      throw new Error(`Invalid args: path traversal detected in argument at index ${index}`)\n    }\n\n    return arg\n  })\n}\n\nexport function performVariableSubstitution(","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/CherryHQ/cherry-studio/blob/726446b54cd69ffe51a276638672f6d95ca0768c/src/main/ai/mcp/McpPackageService.ts#L161-L197","documentation":"Thrown by validateArgs() during the per-element map when an argument at the given index is not of type string. The function iterates the args array and type-checks each element before checking for null bytes or path traversal. The error message includes the offending index for easy identification.","triggerScenarios":"Called from resolveMcpConfig at line 359. Triggers when the args array contains non-string elements — e.g., [123], ['--port', null], ['--config', { key: 'value' }]. Variable substitution could also introduce a non-string if a user_config value is not a string.","commonSituations":"A manifest author mixed types in the args array (numbers, booleans, nulls); a JSON parsing edge case converted a value; variable substitution from user_config injected a non-string; a platform_override replaced the args with a mixed-type array.","solutions":["Ensure every element in the manifest's args array is a string. Convert numbers or other types to strings if needed.","If using variable substitution, verify user_config values are strings.","Validate the manifest with a schema that enforces items: { type: 'string' } on the args array."],"exampleFix":"// before (manifest fragment)\n\"args\": [\"--port\", 3000]\n\n// after\n\"args\": [\"--port\", \"3000\"]","handlingStrategy":"type-guard","validationCode":"// Validate each arg is a string before calling validateArgs\nif (!args.every(arg => typeof arg === 'string')) {\n  const badIndex = args.findIndex(arg => typeof arg !== 'string')\n  throw new Error(`Argument at index ${badIndex} is not a string`)\n}","typeGuard":"function isStringArray(value: unknown): value is string[] {\n  return Array.isArray(value) && value.every(item => typeof item === 'string')\n}","tryCatchPattern":null,"preventionTips":["Enforce items: { type: 'string' } in the manifest JSON schema for the args array.","Convert non-string args to strings at the manifest-loading boundary if they are legitimate.","Test manifests with mixed-type args arrays to confirm validation catches them."],"tags":["validation","mcp","manifest","type-error"],"backgroundTag":null,"analyzedSha":"726446b54cd69ffe51a276638672f6d95ca0768c","analyzedAt":"2026-08-12T17:30:37.448Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}