{"record":{"id":"79c402e4fc56b1c8","repo":"JuliusBrussee/caveman","slug":"native-session-marker-invalid-key-or-session-id","errorCode":null,"errorMessage":"native session marker: invalid key or session id","messagePattern":"native session marker: invalid key or session id","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/internal/nativeruntime/marker.go","lineNumber":73,"sourceCode":"\t}\n\tkey, err = os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"native session key read: %w\", err)\n\t}\n\tif len(key) != sessionKeyBytes {\n\t\treturn nil, fmt.Errorf(\"native session key length = %d, want %d\", len(key), sessionKeyBytes)\n\t}\n\tif err := os.Chmod(path, 0o600); err != nil {\n\t\treturn nil, fmt.Errorf(\"native session key chmod: %w\", err)\n\t}\n\treturn key, nil\n}\n\n// SessionMarker builds model-temporary correlation context. Local proxy removes\n// valid markers byte-surgically before provider inspection or forwarding.\nfunc SessionMarker(key []byte, sessionID string) (string, error) {\n\tif len(key) != sessionKeyBytes || sessionID == \"\" || len(sessionID) > 256 {\n\t\treturn \"\", errors.New(\"native session marker: invalid key or session id\")\n\t}\n\tencoded := base64.RawURLEncoding.EncodeToString([]byte(sessionID))\n\tsig := markerMAC(key, encoded)\n\treturn fmt.Sprintf(`[[caveman-session-v1 sid=\"%s\" sig=\"%s\"]]`, encoded, sig), nil\n}\n\n// StripSessionMarkers removes only valid HMAC-signed markers. Invalid marker-\n// shaped user text remains byte-identical. Conflicting valid session IDs are\n// stripped but return no correlation identity.\nfunc StripSessionMarkers(body, key []byte) (stripped []byte, sessionID string, changed bool) {\n\tif len(key) != sessionKeyBytes {\n\t\treturn body, \"\", false\n\t}\n\tmatches := markerPattern.FindAllSubmatchIndex(body, -1)\n\tif len(matches) == 0 {\n\t\treturn body, \"\", false\n\t}\n\tout := make([]byte, 0, len(body))","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/proxy/internal/nativeruntime/marker.go#L55-L91","documentation":"SessionMarker validated its inputs before building the signed correlation marker and found the session key unusable (nil/wrong length) or the session id invalid (empty/too long/bad characters). Markers are HMAC-protected, so malformed inputs are refused outright.","triggerScenarios":"Thrown at proxy/internal/nativeruntime/marker.go:73 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Load the session key via the runtime helper that enforces the 32-byte length","Pass a non-empty, identity-safe session id"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}