{"record":{"id":"96e92ed6275fc0f3","repo":"CherryHQ/cherry-studio","slug":"invalid-args-must-be-an-array","errorCode":null,"errorMessage":"Invalid args: must be an array","messagePattern":"Invalid args: must be an array","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/ai/mcp/McpPackageService.ts","lineNumber":174,"sourceCode":"  // Check for null bytes\n  if (trimmed.includes('\\0')) {\n    throw new Error('Invalid command: null byte detected')\n  }\n\n  return trimmed\n}\n\n/**\n * Validate command arguments to prevent injection attacks.\n * Rejects arguments containing path traversal sequences.\n *\n * @param args - The arguments array to validate\n * @returns The validated arguments array\n * @throws Error if any argument contains path traversal\n */\nexport function validateArgs(args: string[]): string[] {\n  if (!Array.isArray(args)) {\n    throw new Error('Invalid args: must be an array')\n  }\n\n  return args.map((arg, index) => {\n    if (typeof arg !== 'string') {\n      throw new Error(`Invalid args: argument at index ${index} must be a string`)\n    }\n\n    // Check for null bytes\n    if (arg.includes('\\0')) {\n      throw new Error(`Invalid args: null byte detected in argument at index ${index}`)\n    }\n\n    // Check for path traversal in arguments that look like paths\n    // Only validate if the arg contains path separators (indicating it's meant to be a path)\n    if ((arg.includes('/') || arg.includes('\\\\')) && /(?:^|[/\\\\])\\.\\.(?:[/\\\\]|$)/.test(arg)) {\n      throw new Error(`Invalid args: path traversal detected in argument at index ${index}`)\n    }\n","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/CherryHQ/cherry-studio/blob/726446b54cd69ffe51a276638672f6d95ca0768c/src/main/ai/mcp/McpPackageService.ts#L156-L192","documentation":"Thrown by validateArgs() when the args field from an MCP package manifest is not an array. MCP package manifests define server.mcp_config.args as a string[], so a non-array value (object, string, number, null) is a schema violation. This is the first validation gate in validateArgs, checked before iterating individual elements.","triggerScenarios":"Called from resolveMcpConfig at line 359 after variable substitution and mapping. Triggers when the manifest's args field is a non-array type — e.g., { args: '--port 3000' } (string instead of array), { args: null }, or the field is absent and defaulted to a non-array value.","commonSituations":"A manifest author wrote args as a single string instead of an array of strings; a platform_override replaced the args array with a non-array value; a schema migration or manual edit corrupted the args field type.","solutions":["Set the manifest's args to a JSON array of strings, e.g., ['--port', '3000'] instead of '--port 3000'.","If using platform_overrides, verify each override's args field is an array.","Validate the manifest JSON against the DXT/MCPB schema before installation."],"exampleFix":"// before (manifest fragment)\n\"mcp_config\": { \"command\": \"node\", \"args\": \"--port 3000\" }\n\n// after\n\"mcp_config\": { \"command\": \"node\", \"args\": [\"--port\", \"3000\"] }","handlingStrategy":"type-guard","validationCode":"// Validate args is an array before calling validateArgs\nif (!Array.isArray(manifest.server.mcp_config.args)) {\n  throw new Error('Manifest args field must be an array of strings')\n}","typeGuard":"function isStringArray(value: unknown): value is string[] {\n  return Array.isArray(value) && value.every(item => typeof item === 'string')\n}","tryCatchPattern":null,"preventionTips":["Enforce args: { type: 'array', items: { type: 'string' } } in the manifest JSON schema.","Type-check the args field before passing to validateArgs.","Test manifests with non-array args values to confirm schema validation catches them."],"tags":["validation","mcp","manifest","type-error"],"backgroundTag":null,"analyzedSha":"726446b54cd69ffe51a276638672f6d95ca0768c","analyzedAt":"2026-08-12T17:30:37.448Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}