{"record":{"id":"70d5e1870db4361b","repo":"openclaw/openclaw","slug":"buzz-qa-credentials-are-missing-or-malformed","errorCode":null,"errorMessage":"Buzz QA credentials are missing or malformed.","messagePattern":"Buzz QA credentials are missing or malformed\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"extensions/buzz/src/qa/credentials.ts","lineNumber":42,"sourceCode":"    // stay on loopback and never cross a network boundary.\n    relayUrl: z.string().url().refine(isSafeBuzzQaRelayUrl),\n    roomId: z.string().min(1),\n    driverPrivateKey: z.string().min(1),\n    sutPrivateKey: z.string().min(1),\n    driverAuthTag: z.string().optional(),\n    sutAuthTag: z.string().optional(),\n  })\n  .strict();\n\nexport type BuzzQaCredentials = z.output<typeof buzzQaCredentialPayloadSchema> & {\n  driverPublicKey: string;\n  sutPublicKey: string;\n};\n\nexport function parseBuzzQaCredentialPayload(payload: unknown): BuzzQaCredentials {\n  const parsed = buzzQaCredentialPayloadSchema.safeParse(payload);\n  if (!parsed.success) {\n    throw new Error(\"Buzz QA credentials are missing or malformed.\");\n  }\n  let roomId: string;\n  let driverPublicKey: string;\n  let sutPublicKey: string;\n  try {\n    roomId = parseBuzzTarget(parsed.data.roomId);\n    driverPublicKey = resolveBuzzPublicKey(parsed.data.driverPrivateKey);\n    sutPublicKey = resolveBuzzPublicKey(parsed.data.sutPrivateKey);\n    parseBuzzAuthTag(parsed.data.driverAuthTag ?? \"\");\n    parseBuzzAuthTag(parsed.data.sutAuthTag ?? \"\");\n  } catch {\n    throw new Error(\"Buzz QA credentials are missing or malformed.\");\n  }\n  if (driverPublicKey === sutPublicKey) {\n    throw new Error(\"Buzz QA requires distinct driver and SUT identities.\");\n  }\n  return {\n    ...parsed.data,","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/openclaw/openclaw/blob/01804a75319da4b69c9ab98ceaa30477e22b8c0b/extensions/buzz/src/qa/credentials.ts#L24-L60","documentation":"Thrown by parseBuzzQaCredentialPayload when the Zod strict-object schema validation (safeParse) fails on the credential payload. The schema requires relayUrl (safe URL), roomId (non-empty), driverPrivateKey (non-empty), sutPrivateKey (non-empty), optional driverAuthTag and sutAuthTag, and rejects unknown keys due to .strict(). This is the primary credential validation entry point used by both file and convex credential sources.","triggerScenarios":"Missing a required field (relayUrl, roomId, driverPrivateKey, or sutPrivateKey); including an unknown key like 'extra'; relayUrl is not a valid URL or fails the SSRF-safe refine check (must be wss: or loopback ws:); passing a non-object payload.","commonSituations":"Hand-editing a credential JSON and dropping a field; typo in a key name; using http: relay URL instead of wss:; using ws: to a non-loopback host.","solutions":["Ensure the JSON has all required fields: relayUrl, roomId, driverPrivateKey, sutPrivateKey.","Remove any fields not in the schema (the schema is strict).","Verify relayUrl uses wss: (or ws: only for 127.0.0.1/localhost/[::1]).","Run the JSON through a validator or compare against a known-good credential file."],"exampleFix":"// before\n{ \"relayUrl\": \"http://relay.example.com\", \"roomId\": \"...\", \"driverPrivateKey\": \"...\", \"sutPrivateKey\": \"...\" }\n// after\n{ \"relayUrl\": \"wss://relay.example.com\", \"roomId\": \"...\", \"driverPrivateKey\": \"...\", \"sutPrivateKey\": \"...\" }","handlingStrategy":"validation","validationCode":"import { z } from 'zod';\nimport { isLoopbackHost } from 'openclaw/plugin-sdk/ssrf-runtime';\n\nconst schema = z.object({\n  relayUrl: z.string().url().refine((v) => {\n    const u = new URL(v);\n    return u.protocol === 'wss:' || (u.protocol === 'ws:' && isLoopbackHost(u.hostname));\n  }),\n  roomId: z.string().min(1),\n  driverPrivateKey: z.string().min(1),\n  sutPrivateKey: z.string().min(1),\n  driverAuthTag: z.string().optional(),\n  sutAuthTag: z.string().optional(),\n}).strict();\n\nconst result = schema.safeParse(rawPayload);\nif (!result.success) {\n  console.error('Schema errors:', result.error.issues);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the credential JSON against the schema before passing it to the adapter.","Use .strict() to catch typos in field names early.","Ensure relayUrl uses wss: for production and ws: only for loopback."],"tags":["buzz","qa","credentials","validation","zod","schema"],"backgroundTag":null,"analyzedSha":"01804a75319da4b69c9ab98ceaa30477e22b8c0b","analyzedAt":"2026-08-12T04:37:58.197Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}