{"record":{"id":"d3fb0c3b4773d257","repo":"different-ai/openwork","slug":"the-local-managed-mcp-vault-payload-is-invalid","errorCode":null,"errorMessage":"The local managed MCP vault payload is invalid.","messagePattern":"The local managed MCP vault payload is invalid\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"apps/server/src/local-managed-mcp.ts","lineNumber":311,"sourceCode":"    return {\n      envelope: value.vault,\n      index: readVaultIndex(value.index),\n      lastRecovery: isVaultRecovery(value.lastRecovery) ? value.lastRecovery : null,\n    };\n  }\n  throw new Error(\"The local managed MCP vault envelope is invalid.\");\n}\n\nfunction decryptVault(envelope: VaultEnvelope, key: Buffer): LocalManagedMcpVault {\n  const decipher = createDecipheriv(\"aes-256-gcm\", key, Buffer.from(envelope.iv, \"base64\"));\n  decipher.setAAD(VAULT_AAD);\n  decipher.setAuthTag(Buffer.from(envelope.tag, \"base64\"));\n  const plaintext = Buffer.concat([\n    decipher.update(Buffer.from(envelope.data, \"base64\")),\n    decipher.final(),\n  ]).toString(\"utf8\");\n  const value: unknown = JSON.parse(plaintext);\n  if (!isVault(value)) throw new Error(\"The local managed MCP vault payload is invalid.\");\n  return value;\n}\n\nfunction vaultIndexEntry(connection: StoredLocalManagedMcpConnection): LocalManagedMcpIndexEntry {\n  return {\n    id: connection.id,\n    workspaceId: connection.workspaceId,\n    name: connection.name,\n    serverUrl: connection.serverUrl,\n    enabled: connection.enabled,\n    oauth: {\n      applicationType: connection.oauth.applicationType,\n      ...(connection.oauth.requestedScopes ? { requestedScopes: connection.oauth.requestedScopes } : {}),\n      ...(connection.oauth.authorizationServerIssuer ? { authorizationServerIssuer: connection.oauth.authorizationServerIssuer } : {}),\n      ...(connection.oauth.clientId ? { clientId: connection.oauth.clientId } : {}),\n    },\n    status: connection.status,\n    ...(connection.lastError === undefined ? {} : { lastError: connection.lastError }),","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/apps/server/src/local-managed-mcp.ts#L293-L329","documentation":"decryptVault successfully authenticated the envelope's AES-256-GCM tag but the decrypted plaintext either is not valid JSON or fails the isVault shape check, so it throws this plain Error. This means the vault key decrypted the file but the payload content is not a valid vault structure.","triggerScenarios":"loadVaultLocked decrypts an envelope whose plaintext was overwritten, written by an incompatible schema, or is not the expected JSON vault object.","commonSituations":"Vault plaintext manually edited while encrypted; a vault file from a different app/version whose key happens to work; plaintext produced by a partially failed migration; someone replaced `data` with encrypted content of an unrelated JSON blob.","solutions":["Restore the vault from backup or re-initialize it (re-enter stored secrets)","Use the vault recovery flow (lastRecovery / recovery key) to re-seal a fresh vault","Confirm the vault and app versions are compatible — re-run any pending migrations","Check the key being loaded belongs to this vault (a mismatched key usually fails the GCM tag instead, so if you get here the data itself is wrong)"],"exampleFix":"// before (data encrypted from wrong payload)\nenvelope.data = encrypt(JSON.stringify({ foo: 1 }), key);\n// after\nenvelope.data = encrypt(JSON.stringify(buildValidVaultPayload()), key);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const vault = loadVaultLocked(keyFile);\n} catch (error) {\n  if (error.message === \"The local managed MCP vault payload is invalid.\") {\n    // key was correct but payload is not a vault: restore from backup or use recovery flow\n  }\n  throw error;\n}","preventionTips":["Keep backups of vault files before any manual decryption/encryption work","Run schema migrations instead of hand-editing encrypted payloads","Verify the encrypted payload round-trips (decrypt + shape-check) after any custom tooling touches the vault","Use the documented recovery flow for corrupted vaults rather than improvising re-encryption"],"tags":["vault","encryption","aes-gcm","schema-validation"],"backgroundTag":"vault-payload-invalid","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}