Problem
decryptPassword destructures encoded.split(':') into [ivB64, authTagB64, encryptedB64] and immediately calls Buffer.from(<undefined>, 'base64') with no checks. A malformed stored value throws a cryptic error. The sibling decryptSecret in totp.ts does validate; decryptPassword does not.
Location
apps/web/src/lib/spawner/crypto.ts:23-31
Impact
Callers like chat/stream/route.ts:324 invoke decryptPassword without a try/catch, so a corrupt serverPassword yields an opaque 500 with no useful diagnostic. Related to issue #88 (closed, but only decryptSecret was fixed).
Suggested fix
Add the same if (!ivB64 || !authTagB64 || !encryptedB64) throw new Error('Malformed encrypted password') guard already present in decryptSecret.
Source: code investigation.
Problem
decryptPassworddestructuresencoded.split(':')into[ivB64, authTagB64, encryptedB64]and immediately callsBuffer.from(<undefined>, 'base64')with no checks. A malformed stored value throws a cryptic error. The siblingdecryptSecretintotp.tsdoes validate;decryptPassworddoes not.Location
apps/web/src/lib/spawner/crypto.ts:23-31Impact
Callers like
chat/stream/route.ts:324invokedecryptPasswordwithout a try/catch, so a corruptserverPasswordyields an opaque 500 with no useful diagnostic. Related to issue #88 (closed, but onlydecryptSecretwas fixed).Suggested fix
Add the same
if (!ivB64 || !authTagB64 || !encryptedB64) throw new Error('Malformed encrypted password')guard already present indecryptSecret.Source: code investigation.