What causes "Login password must be at least 8 characters." in sipeed/picoclaw?

Choose a password of 8 or more characters (code points)

Login password must be at least 8 characters.

Error message

Login password must be at least 8 characters.

What it means

Validation error thrown in handleSave (web/frontend/src/components/config/config-page.tsx:308, message from i18n key pages.config.dashboard_password_min_length) when the trimmed password has fewer than 8 code points. Note the check is Array.from(password).length, which counts Unicode code points, not UTF-16 units — an emoji counts as 1 even though its .length is 2. Client-side mirror of the minimum length enforced by POST /api/auth/setup.

Source

Thrown at web/frontend/src/components/config/config-page.tsx:308

    } finally {
      setShowFactoryResetDialog(false)
    }
  }

  const handleSave = async () => {
    try {
      setSaving(true)
      const password = launcherForm.dashboardPassword.trim()
      const confirm = launcherForm.dashboardPasswordConfirm.trim()
      if (launcherPasswordDirty) {
        if (!password) {
          throw new Error(t("pages.config.dashboard_password_required"))
        }
        if (password !== confirm) {
          throw new Error(t("pages.config.dashboard_password_mismatch"))
        }
        if (Array.from(password).length < 8) {
          throw new Error(t("pages.config.dashboard_password_min_length"))
        }
      }

      if (configDirty) {
        const workspace = form.workspace.trim()
        const dmScope = form.dmScope.trim()

        if (!workspace) {
          throw new Error("Workspace path is required.")
        }
        if (!dmScope) {
          throw new Error("Session scope is required.")
        }

        if (
          form.mcpEnabled &&
          form.mcpDiscoveryEnabled &&
          !form.mcpDiscoveryUseBM25 &&

View on GitHub (pinned to 49183d7e8d)

Solutions

Choose a password of 8 or more characters (code points)
Use a generated passphrase from a password manager to satisfy length safely
Remember leading/trailing whitespace is stripped before counting

Defensive patterns

Strategy: validation

Validate before calling

const MIN = 8
if (launcherPasswordDirty && Array.from(password).length < MIN) {
  setFieldError(`Login password must be at least ${MIN} characters.`)
  return
}

Try / catch

try {
  await handleSave()
} catch (err) {
  if (err instanceof Error) setError(err.message)
}

Prevention

Show a live character counter on the password field
Match the client minimum to the backend /api/auth/setup rule so they never disagree
Remember count is in Unicode code points; do not rely on String.length near the boundary

When it happens

Trigger: Entering 1-7 characters (after trim) into a dirty dashboard password field and saving; multi-byte characters do not help since code points are counted.

Common situations: User attempts a short PIN-style password; password manager generated a 6-char password; user counts an emoji as two characters and is surprised it still fails.

Related errors

AI-assisted analysis of sipeed/picoclaw@49183d7e8d (2026-08-15). Data as JSON: /api/errors/6788c28167e8375e. Report an issue: GitHub.