{"record":{"id":"af2ebebba454800f","repo":"stablyai/orca","slug":"minimax-session-cookie-must-be-a-string","errorCode":null,"errorMessage":"MiniMax session cookie must be a string","messagePattern":"MiniMax session cookie must be a string","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/main/ipc/minimax-credentials.ts","lineNumber":36,"sourceCode":"// Why: fire-and-forget — callers get the persisted cookie status immediately;\n// the rate-limit refresh runs in the background and only logs on failure.\nfunction refreshAfterMiniMaxCredentialChange(\n  rateLimits: RateLimitService | null,\n  action: 'save' | 'clear'\n): void {\n  rateLimits?.invalidateMiniMaxCredentialState()\n  void rateLimits?.refresh().catch((error: unknown) => {\n    console.error(`[minimax] failed to trigger rate-limit refresh after ${action}:`, error)\n  })\n}\n\nexport function registerMiniMaxCredentialsHandlers(rateLimits: RateLimitService | null): void {\n  ipcMain.handle('minimaxCredentials:getStatus', () => getMiniMaxCredentialsStatus())\n  ipcMain.handle('minimaxCredentials:saveCookie', (_event, cookie: string) => {\n    // Validate the IPC argument in the main process; the renderer-declared type\n    // is compile-time only and the value arrives as unknown over IPC.\n    if (typeof cookie !== 'string') {\n      throw new Error('MiniMax session cookie must be a string')\n    }\n    saveMiniMaxSessionCookie(cookie)\n    refreshAfterMiniMaxCredentialChange(rateLimits, 'save')\n    return getMiniMaxCredentialsStatus()\n  })\n  ipcMain.handle('minimaxCredentials:clearCookie', async () => {\n    clearMiniMaxSessionCookie()\n    try {\n      await clearMiniMaxSessionCookieJar()\n    } catch (error) {\n      console.error('[minimax] failed to clear session cookie jar after credential clear:', error)\n    }\n    refreshAfterMiniMaxCredentialChange(rateLimits, 'clear')\n    return getMiniMaxCredentialsStatus()\n  })\n}\n","sourceCodeStart":18,"sourceCodeEnd":53,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/src/main/ipc/minimax-credentials.ts#L18-L53","documentation":"Thrown by the minimaxCredentials:saveCookie IPC handler when the cookie argument is not of type string. The handler explicitly re-validates the IPC argument in the main process because the renderer-declared TypeScript type is compile-time only and the value arrives as unknown over IPC. This prevents non-string (or crafted) input from reaching saveMiniMaxSessionCookie.","triggerScenarios":"Calling minimaxCredentials:saveCookie with a non-string cookie value: a number, object, null, undefined, or array. The renderer's type system may claim string, but the runtime value differs (e.g. a form state holding null before input).","commonSituations":"The cookie input field holds null/undefined initially and is forwarded before the user types. A copy-paste handler assigns an object. Automated/programmatic IPC calls pass the wrong shape.","solutions":["Coerce and validate the cookie to a string before invoking minimaxCredentials:saveCookie.","Disable the save action until the cookie field is a non-empty string.","Do not forward raw form state; extract and type-check the value."],"exampleFix":"// before\nawait ipc.call('minimaxCredentials:saveCookie', cookieState.value)\n\n// after\nconst cookie = cookieState.value\nif (typeof cookie !== 'string' || !cookie.trim()) throw new Error('Cookie required')\nawait ipc.call('minimaxCredentials:saveCookie', cookie)","handlingStrategy":"type-guard","validationCode":"if (typeof cookie !== 'string' || !cookie.trim()) {\n  throw new Error('MiniMax session cookie must be a non-empty string')\n}","typeGuard":"function isCookieString(value: unknown): value is string {\n  return typeof value === 'string' && value.trim().length > 0\n}","tryCatchPattern":null,"preventionTips":["Coerce the cookie input to a string and validate non-empty before saving.","Disable the save action until the cookie field holds a non-empty string.","Do not forward raw form state that may be null/undefined."],"tags":["validation","credentials","minimax","ipc","type-safety"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}