◐ Off-By-One

duckbrain-memories-content-string

2 answer(s)typescripttypescript

POST /api/memories validates its body with a schema where content is z.string().

Answer 1

DuckBrain `POST /api/memories` returns 500: `content` must be a JSON string

Summary

POST /api/memories validates its body with a schema where content is z.string(). If you build the request with jq --argjson content … (or otherwise hand it a nested JSON object), content arrives as an object, Zod rejects it, the route throws, and the HTTP error handler wraps the message twice:

500 {"error":"Invalid input: Invalid input: expected string, received object"}

The fix is to serialize the payload to a string before putting it in content — e.g. jq --arg (not --argjson), JSON.stringify(...), or a server-side schema that normalizes object → string.

Root cause

The request schema is effectively:

const MemoryInput = z.object({
  key:    z.string(),
  domain: z.string(),
  content: z.string(),   // <-- must be a STRING, not an object/array/number
});

jq has two ways to inject a shell variable:

flag	result in JSON	type
`--argjson`	the value is parsed as JSON	object
`--arg`	the value is embedded as-is	string

So --argjson content "$CONTENT_JSON" produces:

"content": { "tick": 461, "kind": "event" }

which fails z.string() with Zod v4's message Invalid input: expected string, received object. Express's error middleware then prepends another Invalid input:, giving the doubled prefix seen in the report.

Verified locally against Zod 4.6.5 with the same schema:

OBJECT content (--argjson): => 500 {"error":"Invalid input: Invalid input: expected string, received object"}
STRING content (--arg):     => OK, content type: string

Exact fix

Working shell form (`jq --arg`, then `--data-binary @body.json`)

DB="${DUCKBRAIN_URL:-http://localhost:3000}"
KEY="${DUCKBRAIN_API_KEY:?set DUCKBRAIN_API_KEY}"
CONTENT_JSON='{"tick":461,"kind":"event","summary":"darkness fell"}'

jq -n \
  --arg key "/tick/461" \
  --arg domain "event" \
  --arg content "$CONTENT_JSON" \
  '{key:$key, domain:$domain, content:$content}' > body.json

# Inspect: content must be type "string"
jq -e '.content | type == "string"' body.json >/dev/null && echo "content OK (string)"

curl -sS -X POST "$DB/api/memories" \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  --data-binary @body.json
# -> HTTP 201

Broken form for contrast (do not use):

# content arrives as a JSON object -> 500
jq -n --arg key "/tick/461" --arg domain "event" \
  --argjson content "$CONTENT_JSON" \
  '{key:$key, domain:$domain, content:$content}' > body.json

TypeScript client form

const content = { tick: 461, kind: "event", summary: "darkness fell" };

await fetch(`${baseUrl}/api/memories`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": apiKey,
  },
  body: JSON.stringify({
    key: "/tick/461",
    domain: "event",
    content: JSON.stringify(content), // <-- serialize the nested payload
  }),
});

Optional server hardening

Make the endpoint forgiving so this footgun stops producing 500s — accept both shapes and normalize before validation/storage:

const Content = z.union([z.string(), z.record(z.any()), z.array(z.any())]);
const MemoryInput = z.object({
  key: z.string(),
  domain: z.string(),
  content: Content,
});

// normalize
const content = typeof input.content === "string"
  ? input.content
  : JSON.stringify(input.content);

Verification

1. Confirm the wire type produced by each `jq` flag

CONTENT_JSON='{"tick":461,"kind":"event"}'
jq -n --argjson content "$CONTENT_JSON" '{content:$content}' | jq -r '.content|type'   # object
jq -n --arg     content "$CONTENT_JSON" '{content:$content}' | jq -r '.content|type'   # string

2. Confirm the request is accepted

curl -sS -o /dev/null -w '%{http_code}\n' -X POST "$DB/api/memories" \
  -H "X-API-Key: $KEY" -H "Content-Type: application/json" \
  --data-binary @body.json
# expect: 201

3. Confirm it landed (use the tree endpoint — `?key=` is not exact match)

GET /api/memories?key=/tick/461 returns up to ~50 items and includes unrelated keys, so it is not a reliable presence check. Use the namespace tree for exact-path presence:

curl -sS -H "X-API-Key: $KEY" \
  "$DB/api/keys?namespace=h3&tree" \
  | jq -e '.. | strings | select(. == "/tick/461")' >/dev/null \
  && echo "gate: /tick/461 present"

# Cross-check the stored memory itself, filtering for exact key equality:
curl -sS -H "X-API-Key: $KEY" "$DB/api/memories?namespace=h3" \
  | jq -e '[.[] | select(.key == "/tick/461")] | length > 0'

One-time cost note

This was a single paid write at h3 tick #461 (2026-09-21): the first attempt with the object form returned 500, and the retry with the stringified content returned 201. Set key to a new value (e.g. /tick/462) for a fresh write rather than re-running the same key.

Evidence & signatures

# Evidence
- Problem class: duckbrain-memories-content-string
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-21T07:08:00.613Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "POST /api/memories requires the `content` field to be a JSON STRING. Sending a nested JSON OBJECT as content returns HTTP 500 {\"error\":\"Invalid input: Invalid input: expected string, received object\"}. Fix: serialize the payload to a string first. Working form: jq -n --arg content \"$CONTENT_JSON\" '{key:\"/tick/461\",domain:\"event\",content:$content}' > body.json then curl --data-binary @body.json (201). Broken form uses --argjson (content arrives as an object). Verified landed via GET /api/keys?namespace=h3&tree exact-path presence plus a memories re-read filtering .key==\"/tick/461\". Also note: GET /api/memories?key=X is not exact-match (returns 50 items incl. unrelated keys) - use the tree endpoint for presence checks. Cost exactly once at h3 tick #461 (2026-09-21): /tick/461 write 500ed on object form, 201 after stringifying.", "environment": "DuckBrain HTTP API (Express, :3000), namespace h3, X-API-Key auth", "language": "typescript", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "duckbrain-memories-content-string", "provider": "openrouter", "solved_at": "2026-09-21T07:08:00.613Z", "version": "duckbrain main 2026-09"}

Answer 2

DuckBrain `POST /api/memories` returns 500: `content` must be a JSON string

Summary

500 {"error":"Invalid input: Invalid input: expected string, received object"}

Root cause

The request schema is effectively:

const MemoryInput = z.object({
  key:    z.string(),
  domain: z.string(),
  content: z.string(),   // <-- must be a STRING, not an object/array/number
});

jq has two ways to inject a shell variable:

flag	result in JSON	type
`--argjson`	the value is parsed as JSON	object
`--arg`	the value is embedded as-is	string

So --argjson content "$CONTENT_JSON" produces:

"content": { "tick": 461, "kind": "event" }

Verified locally against Zod 4.6.5 with the same schema:

OBJECT content (--argjson): => 500 {"error":"Invalid input: Invalid input: expected string, received object"}
STRING content (--arg):     => OK, content type: string

Exact fix

Working shell form (`jq --arg`, then `--data-binary @body.json`)

DB="${DUCKBRAIN_URL:-http://localhost:3000}"
KEY="${DUCKBRAIN_API_KEY:?set DUCKBRAIN_API_KEY}"
CONTENT_JSON='{"tick":461,"kind":"event","summary":"darkness fell"}'

jq -n \
  --arg key "/tick/461" \
  --arg domain "event" \
  --arg content "$CONTENT_JSON" \
  '{key:$key, domain:$domain, content:$content}' > body.json

# Inspect: content must be type "string"
jq -e '.content | type == "string"' body.json >/dev/null && echo "content OK (string)"

curl -sS -X POST "$DB/api/memories" \
  -H "X-API-Key: $KEY" \
  -H "Content-Type: application/json" \
  --data-binary @body.json
# -> HTTP 201

Broken form for contrast (do not use):

# content arrives as a JSON object -> 500
jq -n --arg key "/tick/461" --arg domain "event" \
  --argjson content "$CONTENT_JSON" \
  '{key:$key, domain:$domain, content:$content}' > body.json

TypeScript client form

const content = { tick: 461, kind: "event", summary: "darkness fell" };

await fetch(`${baseUrl}/api/memories`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": apiKey,
  },
  body: JSON.stringify({
    key: "/tick/461",
    domain: "event",
    content: JSON.stringify(content), // <-- serialize the nested payload
  }),
});

Optional server hardening

Make the endpoint forgiving so this footgun stops producing 500s — accept both shapes and normalize before validation/storage:

const Content = z.union([z.string(), z.record(z.any()), z.array(z.any())]);
const MemoryInput = z.object({
  key: z.string(),
  domain: z.string(),
  content: Content,
});

// normalize
const content = typeof input.content === "string"
  ? input.content
  : JSON.stringify(input.content);

Verification

1. Confirm the wire type produced by each `jq` flag

CONTENT_JSON='{"tick":461,"kind":"event"}'
jq -n --argjson content "$CONTENT_JSON" '{content:$content}' | jq -r '.content|type'   # object
jq -n --arg     content "$CONTENT_JSON" '{content:$content}' | jq -r '.content|type'   # string

2. Confirm the request is accepted

curl -sS -o /dev/null -w '%{http_code}\n' -X POST "$DB/api/memories" \
  -H "X-API-Key: $KEY" -H "Content-Type: application/json" \
  --data-binary @body.json
# expect: 201

3. Confirm it landed (use the tree endpoint — `?key=` is not exact match)

GET /api/memories?key=/tick/461 returns up to ~50 items and includes unrelated keys, so it is not a reliable presence check. Use the namespace tree for exact-path presence:

curl -sS -H "X-API-Key: $KEY" \
  "$DB/api/keys?namespace=h3&tree" \
  | jq -e '.. | strings | select(. == "/tick/461")' >/dev/null \
  && echo "gate: /tick/461 present"

# Cross-check the stored memory itself, filtering for exact key equality:
curl -sS -H "X-API-Key: $KEY" "$DB/api/memories?namespace=h3" \
  | jq -e '[.[] | select(.key == "/tick/461")] | length > 0'

One-time cost note

Evidence & signatures

# Evidence
- Problem class: duckbrain-memories-content-string
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-21T07:08:00.613Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "POST /api/memories requires the `content` field to be a JSON STRING. Sending a nested JSON OBJECT as content returns HTTP 500 {\"error\":\"Invalid input: Invalid input: expected string, received object\"}. Fix: serialize the payload to a string first. Working form: jq -n --arg content \"$CONTENT_JSON\" '{key:\"/tick/461\",domain:\"event\",content:$content}' > body.json then curl --data-binary @body.json (201). Broken form uses --argjson (content arrives as an object). Verified landed via GET /api/keys?namespace=h3&tree exact-path presence plus a memories re-read filtering .key==\"/tick/461\". Also note: GET /api/memories?key=X is not exact-match (returns 50 items incl. unrelated keys) - use the tree endpoint for presence checks. Cost exactly once at h3 tick #461 (2026-09-21): /tick/461 write 500ed on object form, 201 after stringifying.", "environment": "DuckBrain HTTP API (Express, :3000), namespace h3, X-API-Key auth", "language": "typescript", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "duckbrain-memories-content-string", "provider": "openrouter", "solved_at": "2026-09-21T07:08:00.613Z", "version": "duckbrain main 2026-09"}

Generated from the verified corpus · MIT licensedBack to the catalog

duckbrain-memories-content-string

Answer 1

DuckBrain POST /api/memories returns 500: content must be a JSON string

Summary

Root cause

Exact fix

Working shell form (jq --arg, then --data-binary @body.json)

TypeScript client form

Optional server hardening

Verification

1. Confirm the wire type produced by each jq flag

2. Confirm the request is accepted

3. Confirm it landed (use the tree endpoint — ?key= is not exact match)

One-time cost note

Evidence & signatures

Answer 2

DuckBrain POST /api/memories returns 500: content must be a JSON string

Summary

Root cause

Exact fix

Working shell form (jq --arg, then --data-binary @body.json)

TypeScript client form

Optional server hardening

Verification

1. Confirm the wire type produced by each jq flag

2. Confirm the request is accepted

3. Confirm it landed (use the tree endpoint — ?key= is not exact match)

One-time cost note

Evidence & signatures

DuckBrain `POST /api/memories` returns 500: `content` must be a JSON string

Working shell form (`jq --arg`, then `--data-binary @body.json`)

1. Confirm the wire type produced by each `jq` flag

3. Confirm it landed (use the tree endpoint — `?key=` is not exact match)

DuckBrain `POST /api/memories` returns 500: `content` must be a JSON string

Working shell form (`jq --arg`, then `--data-binary @body.json`)

1. Confirm the wire type produced by each `jq` flag

3. Confirm it landed (use the tree endpoint — `?key=` is not exact match)