ruvnet/RuView · error · Error

brain line ${index + 1}: ${errors.join('; ')}

Error message

brain line ${index + 1}: ${errors.join('; ')}

What it means

Raised at auth.py:256 when the Authorization header splits into exactly two parts but the scheme (case-insensitive) is not 'bearer'. The parser only accepts the Bearer scheme even though HTTPBearer from fastapi.security is imported for OpenAPI documentation.

Source

Thrown at harness/homecore/src/brain.js:85

  if (INJECTION.test(combined)) errors.push('record contains instruction-like prompt injection');
  return errors;
}

export function loadBrain(path = CORPUS_PATH) {
  const raw = readFileSync(path, 'utf8').replace(/\r\n/g, '\n');
  if (Buffer.byteLength(raw) > 1_048_576) throw new Error('brain corpus exceeds 1 MiB');
  const records = raw.split('\n').filter(Boolean).map((line, index) => {
    if (Buffer.byteLength(line) > 16_384) {
      throw new Error(`brain line ${index + 1}: exceeds 16 KiB`);
    }
    let record;
    try {
      record = JSON.parse(line);
    } catch (error) {
      throw new Error(`brain line ${index + 1}: ${error.message}`);
    }
    const errors = validateBrainRecord(record, { canonical: true });
    if (errors.length) throw new Error(`brain line ${index + 1}: ${errors.join('; ')}`);
    return Object.freeze(record);
  });
  if (records.length > 1000) throw new Error('brain corpus exceeds 1000 records');
  const ids = new Set();
  for (const record of records) {
    if (ids.has(record.id)) throw new Error(`duplicate brain id: ${record.id}`);
    ids.add(record.id);
  }
  return { records, digest: sha256(raw), bytes: Buffer.byteLength(raw) };
}

function terms(value) {
  return new Set(String(value).toLowerCase().match(/[a-z0-9][a-z0-9_-]{1,}/g) || []);
}

export function searchBrain(query, { limit = 8, path = CORPUS_PATH } = {}) {
  const wanted = terms(query);
  if (!wanted.size) return [];

View on GitHub (pinned to 4685618388)

Solutions

1. Use exactly: Authorization: Bearer <jwt> (any case of 'bearer' works, the JWT must follow)
2. In Postman/clients, set the auth type to Bearer Token rather than Basic or API Key
3. Check any intermediary that may rewrite the scheme

Example fix

# before
Authorization: Basic dXNlcjpwYXNz
# after
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

def valid_scheme(header_value: str) -> bool:
    """The middleware only accepts the Bearer scheme (case-insensitive)."""
    parts = header_value.strip().split()
    return len(parts) == 2 and parts[0].lower() == "bearer"

def is_bearer(value: str) -> bool:
    return isinstance(value, str) and value.strip().lower().startswith("bearer ")

try:
    await middleware._authenticate_request(request)
except AuthenticationError as e:
    if str(e) == "Invalid authentication scheme":
        return json_response({"error": "use Authorization: Bearer <jwt>"}, 401)
    raise

When it happens

Trigger: Sending 'Authorization: Basic dXNlcjpwYXNz' (HTTP Basic); 'Authorization: Token abc123' or 'ApiKey abc' (Django/GraphQL conventions); a proxy or SDK rewriting the scheme; 'Authorization: bearer' variants are fine but 'BearerToken x' is not.

Common situations: Porting a client from another framework whose auth scheme differs; Postman collection with scheme set to Basic/No Auth; API gateways injecting their own scheme; copy-pasting a curl from a service that uses Token instead of Bearer.

Related errors

• brain line ${index + 1}: ${error.message}
• brain corpus exceeds 1000 records
• brain line ${index + 1}: exceeds 16 KiB
• duplicate brain id: ${record.id}
• guidance input must be an object

AI-assisted analysis of ruvnet/RuView@4685618388 (2026-08-16). Data as JSON: /api/errors/8f6cb516e2a69007. Report an issue: GitHub.