stablyai/orca · error · Error

MiniMax session cookie must be a string

Error message

MiniMax session cookie must be a string

What it means

Thrown by the minimaxCredentials:saveCookie IPC handler when the cookie argument is not of type string. The handler explicitly re-validates the IPC argument in the main process because the renderer-declared TypeScript type is compile-time only and the value arrives as unknown over IPC. This prevents non-string (or crafted) input from reaching saveMiniMaxSessionCookie.

Source

Thrown at src/main/ipc/minimax-credentials.ts:36

// Why: fire-and-forget — callers get the persisted cookie status immediately;
// the rate-limit refresh runs in the background and only logs on failure.
function refreshAfterMiniMaxCredentialChange(
  rateLimits: RateLimitService | null,
  action: 'save' | 'clear'
): void {
  rateLimits?.invalidateMiniMaxCredentialState()
  void rateLimits?.refresh().catch((error: unknown) => {
    console.error(`[minimax] failed to trigger rate-limit refresh after ${action}:`, error)
  })
}

export function registerMiniMaxCredentialsHandlers(rateLimits: RateLimitService | null): void {
  ipcMain.handle('minimaxCredentials:getStatus', () => getMiniMaxCredentialsStatus())
  ipcMain.handle('minimaxCredentials:saveCookie', (_event, cookie: string) => {
    // Validate the IPC argument in the main process; the renderer-declared type
    // is compile-time only and the value arrives as unknown over IPC.
    if (typeof cookie !== 'string') {
      throw new Error('MiniMax session cookie must be a string')
    }
    saveMiniMaxSessionCookie(cookie)
    refreshAfterMiniMaxCredentialChange(rateLimits, 'save')
    return getMiniMaxCredentialsStatus()
  })
  ipcMain.handle('minimaxCredentials:clearCookie', async () => {
    clearMiniMaxSessionCookie()
    try {
      await clearMiniMaxSessionCookieJar()
    } catch (error) {
      console.error('[minimax] failed to clear session cookie jar after credential clear:', error)
    }
    refreshAfterMiniMaxCredentialChange(rateLimits, 'clear')
    return getMiniMaxCredentialsStatus()
  })
}

View on GitHub (pinned to 1136503c6a)

Solutions

1. Coerce and validate the cookie to a string before invoking minimaxCredentials:saveCookie.
2. Disable the save action until the cookie field is a non-empty string.
3. Do not forward raw form state; extract and type-check the value.

Example fix

// before
await ipc.call('minimaxCredentials:saveCookie', cookieState.value)

// after
const cookie = cookieState.value
if (typeof cookie !== 'string' || !cookie.trim()) throw new Error('Cookie required')
await ipc.call('minimaxCredentials:saveCookie', cookie)

if (typeof cookie !== 'string' || !cookie.trim()) {
  throw new Error('MiniMax session cookie must be a non-empty string')
}

function isCookieString(value: unknown): value is string {
  return typeof value === 'string' && value.trim().length > 0
}

When it happens

Trigger: Calling minimaxCredentials:saveCookie with a non-string cookie value: a number, object, null, undefined, or array. The renderer's type system may claim string, but the runtime value differs (e.g. a form state holding null before input).

Common situations: The cookie input field holds null/undefined initially and is forwarded before the user types. A copy-paste handler assigns an object. Automated/programmatic IPC calls pass the wrong shape.

Related errors

• No Claude credentials found in ${resolvedDir}. Run `claude l
• Selected file is not a markdown document.
• ${label} is required
• ${label} is required
• Cannot download to a directory

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/af2ebebba454800f. Report an issue: GitHub.