AI & Agent Dev Bug SandboxDefensive Tech Intelligence

Drop in an error log

Name: AI & Agent Dev Bug Sandbox
Creator: AI & Agent Dev Bug Sandbox

A sourced fix-playbook workspace for AI and agent engineers. Find the root cause, the affected version, the rollback-safe next step, and edge-case audits.

Active Intelligence Feed

high95%

Mustache inverted section nested in same-key section misrenders or raises IndexError

The mustache renderer in langchain-core miscounts section nesting when an inverted section with the same key is nested inside a regular list section. This leads to silently wrong output (e.g., '[[]' instead of '[a][b]') or an IndexError. The depth counter used to handle nested regular sections only increments for 'section' tokens, not for 'inverted section' tokens, causing the inner closing tag to be misinterpreted as the outer section's end.

V1.6.3 LangChain

high95%

SummarizationMiddleware fails to identify Claude on Bedrock, causing late summarization and potential context overflow

The SummarizationMiddleware uses a hardcoded check on model._llm_type to apply Claude-specific token calibration. For ChatBedrockConverse (and ChatBedrock), _llm_type is 'amazon_bedrock_converse_chat', which does not match the expected 'anthropic-chat' prefix. As a result, it falls back to the generic chars_per_token=4.0 instead of Claude's calibrated 3.3, underestimating token counts by ~20%. This leads to summarization triggering too late and can cause model calls to fail with 'Input is too long for requested model'.

V<=1.4.1 LangChain

high92%

with_fallbacks(exception_key=...) writes the exception into the caller's own input mapping

The RunnableWithFallbacks methods mutate the caller-provided input dictionary by inserting the exception_key, violating expected immutability and causing unexpected side effects across all six entry points (invoke, ainvoke, batch, abatch, stream, astream).

V1.6.5 Langchain-Core

high65%

Turbopack HMR WebSocket closure on first load breaks initial client-side navigation

In Next.js dev with Turbopack, the HMR WebSocket connection is closed before it is established, causing the first client-side navigation after a fresh page load to delay or fall back to a full page reload. After a manual reload, the connection succeeds and navigation works normally.

Next.js

high92%

cacheComponents: client navigation to generateStaticParams path crashes with React #412 when custom cacheHandler misses

When using Next.js 16.4.0 with cacheComponents and a custom cacheHandler that starts empty (e.g. Redis after eviction), a client-side navigation to a prerendered dynamic route (generateStaticParams) returns an unresumable fallback shell instead of rendering the page, causing React error #412. The issue originates from app-page-runtime.js marking non-prefetch RSC requests as static due to the presence of prefetchDataRoute, and then serving the fallback shell on a cache miss instead of dynamically rendering.

V16.3.8 V16.4.0 V16.5.0-Canary.3 Next.js

high85%

PIIMiddleware(apply_to_output=True) blanks streaming tool call args due to JSON parse failure on partial chunks

When PIIMiddleware is configured with apply_to_output=True and the model streams tool call arguments in multiple chunks, the streaming redaction path treats each chunk's args fragment as complete JSON. Since each fragment is an invalid JSON string, the redactor returns an empty value, causing all tool call arguments to be erased. This leads to tool execution with no arguments and eventually a GraphRecursionError.

Vlangchain-Core==1.6.4 Vlangchain==1.4.2 Langchain

high87%

[langchain-openai] ChatOpenAI.stream() crashes on null function in tool-call delta

When streaming a chat completion, a tool-call delta chunk that includes a null `function` field causes an `AttributeError` inside `_convert_delta_to_message_chunk`. The public `ChatOpenAI.stream()` API terminates unexpectedly instead of ignoring the empty field or preserving the partial tool call.

V1.6.6 Langchain-Openai

high95%

Injected tool arg declared with Pydantic alias is not filtered from on_tool_start's inputs and input_str

An injected tool argument declared with a Pydantic alias (e.g., Field(alias="private_token")) is not stripped from the inputs and input_str passed to on_tool_start callbacks, leaking internal sentinel values to tracing backends.

V1.6.5 Langchain

high75%

Agentic run with dynamic filtering (web_search_20260209) fails due to missing code_execution_tool_result block

LangChain agent using Anthropic's web_search_20260209 tool intermittently fails with a 400 error because the request payload includes a code_execution tool_use without a corresponding code_execution_tool_result. This occurs when web_search triggers automatic code_execution and LangChain's message handling drops the tool result.

Vlangchain==1.3.14 Vlangchain-Core==1.5.3 Vlanggraph==1.2.10 Vlangchain-Anthropic==1.5.4 Vanthropic==0.120.2 Langchain

high85%

Metadata routes with `export const revalidate` are emitted as static files in adapter output, dropping revalidate on Vercel

sitemap.ts (and robots.ts) that export `revalidate` are incorrectly classified as STATIC_FILE in the adapter build output, losing their revalidate value and causing stale content on Vercel. The route is never regenerated and no function is emitted.

V16.2.0 V16.2.11 V16.3.3 V16.3.5 V16.4.0-Canary.38 Next.js

high68%

cacheComponents: RSC and form requests to literal dynamic route URL fail with E592

When a dynamic RSC request or form POST resumes a prerendered page with cacheComponents enabled, the literal bracketed URL segment is treated as a fallback route param, and the combination with cached postponed state triggers invariant E592, causing 500 errors.

V16.4.0-Canary.53 Next.js

high75%

Unexpected JWT invalidation causes forced logout during active editing

Users are unexpectedly logged out while actively editing SQL functions or prompts in Supabase Studio because the access token expires without an automatic refresh, leading to loss of unsaved work.

Supabase

high85%

Sass BOM in concatenated CSS silently breaks selectors with PostCSS 8.5.24+ under webpack

When using Next.js webpack with PostCSS 8.5.24+ and Sass, a BOM emitted by Sass at the start of each module is preserved in the middle of the concatenated CSS asset. This leading U+FEFF becomes part of the first selector of affected modules, causing those CSS rules to silently fail to match elements. The build succeeds without warnings.

Vnext@16.4.0-Canary.53 Vpostcss@>=8.5.24 Next.js

high89%

RunnableSequence silently swallows exceptions in async streaming path

When a step inside RunnableSequence raises an exception during astream(), the exception is caught internally and the stream closes without surfacing the error to the caller. Sync stream() and async ainvoke() propagate correctly; only the async streaming path is affected.

Langchain

high90%

HumanInTheLoopMiddleware cross-tool edit bypasses target tool's interrupt_on policy

An edit decision can change a tool call from tool A to tool B, but the resulting call is evaluated only against tool A's InterruptOnConfig. If tool B has its own interrupt_on policy, it is silently skipped, allowing execution without the required human approval.

V1.3.18 LangChain

high85%

Turbopack module fragments panic when passing a plain function export from a 'use client' module as prop

Next.js 16.5.0-canary.3 with `turbopackModuleFragments` enabled panics during build with `ModuleId not found for ident ... [app-client] (ecmascript) <internal part 0>` when a server component references a plain function exported from a 'use client' module that imports another module.

V16.5.0-Canary.3 Next.js

high95%

openai: malformed tool calls cause all tool calls to be silently dropped

A malformed tool call entry (missing 'function' or 'index') in a streaming OpenAI response causes _convert_delta_to_message_chunk to silently discard all tool call chunks due to a broad except KeyError: pass around a list comprehension.

V<=1.1.11 Langchain

high92%

MCP tools with a parameter named "config" silently broken by LangChain's RunnableConfig injection

When an MCP tool defines an input parameter named 'config' (or 'run_manager' or 'callbacks'), LangChain's StructuredTool invocation overwrites the user-supplied value with the internal RunnableConfig dict, causing silent data corruption and incorrect tool behavior.

Vlangchain-Mcp-Adapters==0.2.2 Vlangchain-Core>=0.3.0,<0.4.0 LangChain

high85%

astream_events v2 does not emit terminal error events for failed runs

The v2 implementation of astream_events fails to emit terminal error events (on_chain_error, on_llm_error, on_chat_model_error, on_retriever_error) when a tracked run raises an exception. Only the corresponding start event is emitted, leaving consumers unable to reliably determine that a run terminated unsuccessfully.

V1.4.8 Langchain-Core

high85%

Windows: @vercel/nft emits globs outside job.base, causing EACCES junction walks

Next.js build tracing with webpack on Windows can fail when a traced dependency computes a home-rooted dynamic path. @vercel/nft then emits a glob whose base directory is the user profile, recursively walking Windows junction cycles (`Application Data` -> `AppData\Local`) and surfacing fatal `EACCES: permission denied, scandir` webpack errors.

V16.2.11 Next.js

high88%

Navigation fails to scroll to top when Suspense fallback renders no DOM nodes

When a route segment uses <Suspense fallback={null}> and the content suspends initially, the InnerScrollHandler effect in layout-router.tsx returns early because no client rects are available, preventing the expected scroll-to-top on navigation. The scroll only occurs on a later navigation. A ResizeObserver-based fix ensures the effect reruns once the suspended content lays out.

V16.4.0 Vcanary Next.js

high87%

DNS NXDOMAIN for active Supabase project qxvnbmwhyrinsarnazkb.supabase.co

User reports that project hostname qxvnbmwhyrinsarnazkb.supabase.co returns NXDOMAIN from public DNS (8.8.8.8) and Chrome reports DNS_PROBE_FINISHED_NXDOMAIN, despite the project being active in the Supabase Dashboard. This indicates a missing DNS record for the project's subdomain in the supabase.co zone, likely due to a provisioning failure.

Supabase

high95%

Default "use cache" handler pins Buffer pool slabs causing memory to exceed cacheMaxMemorySize by up to 22x on Node 26

The default `use cache` handler stores `streamToBuffer` results that may be small slices of a shared Buffer pool slab. Long-lived cache entries therefore retain whole pool slabs (64 KiB on Node 26) while the LRU only counts the slice's bytes, causing actual memory usage to exceed `cacheMaxMemorySize` by up to 22x.

V16.4.0 Next.js

high65%

Supavisor session pooler authentication failure after PostgreSQL password rotation

After rotating the database password in the Supabase Dashboard, connections through the Supavisor Session Pooler begin failing with 'password authentication failed for user "postgres"' despite using the correct new password. The issue is likely caused by Supavisor's secret synchronization not updating its cached credentials, as indicated by the repeated 'SecretChecker not started, using a one-off auth query connection' log message.

Supavisor

high90%

SummarizationMiddleware replaces history with a placeholder when no HumanMessage falls in the trim window

SummarizationMiddleware silently deletes conversation history and inserts the placeholder 'Previous conversation was too long to summarize.' when the only HumanMessage is outside the trimmed token window. The summary model is never called, and with a checkpointer the data loss is persisted.

Langchain

high72%

next build hangs when static generation worker batch exceeds V8 max string length

When cacheComponents is enabled, the export worker serializes the entire batch of static pages' resume data caches into a single IPC message, exceeding Node's maximum string length. process.send throws RangeError: Invalid string length, which becomes an unhandledRejection, leaving the parent waiting indefinitely and causing the build to hang at 'Generating static pages'.

V16.4.0-Canary.58 Next.js

high60%

Management API logs endpoint missing source_name and failing on SELECT *

After logs.all removal, the unified logs table in the Management API endpoint does not expose source_name and returns backend error for basic SELECT * queries, blocking programmatic Edge Function log access.

Supabase Management API

high95%

ChatDeepSeek bind_tools(tool_choice='any') produces invalid request with default thinking mode

When using ChatDeepSeek with default thinking mode enabled, bind_tools(tool_choice='any') (or True) gets normalized to tool_choice='required', which DeepSeek API rejects with HTTP 400. This is due to lack of validation in ChatDeepSeek for thinking mode constraints.

V1.1.0 Langchain-Deepseek

high75%

Invalid URL / Internal Server Error in response to OPTIONS * request

Next.js 16.2.0 and later respond with a 500 Internal Server Error when receiving an OPTIONS * request, whereas earlier versions correctly returned 400 Bad Request or another valid response. This regression affects both development and production servers.

V16.2.0 - 16.4.0-Canary.53 Next.js

high89%

cacheComponents: @vercel/otel's http instrumentation tracer acquired during register() bypasses afterRegistration span patch causing Math.random() prerender error

Next.js cacheComponents span-creation exemption is applied after instrumentation.register() returns, but @vercel/otel FetchInstrumentation captures a concrete Tracer during register(); subsequent outgoing HTTP requests in prerender create spans through that unpatched tracer and trip the sync-IO guard, producing a Math.random() prerender error.

V16.3.6 V16.3.8 V16.4.0-Canary.54 Next.js

Active Intelligence Feed🟢🟢🟢

Mustache inverted section nested in same-key section misrenders or raises IndexError

SummarizationMiddleware fails to identify Claude on Bedrock, causing late summarization and potential context overflow

with_fallbacks(exception_key=...) writes the exception into the caller's own input mapping

Turbopack HMR WebSocket closure on first load breaks initial client-side navigation

cacheComponents: client navigation to generateStaticParams path crashes with React #412 when custom cacheHandler misses

PIIMiddleware(apply_to_output=True) blanks streaming tool call args due to JSON parse failure on partial chunks

[langchain-openai] ChatOpenAI.stream() crashes on null function in tool-call delta

Injected tool arg declared with Pydantic alias is not filtered from on_tool_start's inputs and input_str

Agentic run with dynamic filtering (web_search_20260209) fails due to missing code_execution_tool_result block

Metadata routes with `export const revalidate` are emitted as static files in adapter output, dropping revalidate on Vercel

cacheComponents: RSC and form requests to literal dynamic route URL fail with E592

Unexpected JWT invalidation causes forced logout during active editing

Sass BOM in concatenated CSS silently breaks selectors with PostCSS 8.5.24+ under webpack

RunnableSequence silently swallows exceptions in async streaming path

HumanInTheLoopMiddleware cross-tool edit bypasses target tool's interrupt_on policy

Turbopack module fragments panic when passing a plain function export from a 'use client' module as prop

openai: malformed tool calls cause all tool calls to be silently dropped

MCP tools with a parameter named "config" silently broken by LangChain's RunnableConfig injection

astream_events v2 does not emit terminal error events for failed runs

Windows: @vercel/nft emits globs outside job.base, causing EACCES junction walks

Navigation fails to scroll to top when Suspense fallback renders no DOM nodes

DNS NXDOMAIN for active Supabase project qxvnbmwhyrinsarnazkb.supabase.co

Default "use cache" handler pins Buffer pool slabs causing memory to exceed cacheMaxMemorySize by up to 22x on Node 26

Supavisor session pooler authentication failure after PostgreSQL password rotation

SummarizationMiddleware replaces history with a placeholder when no HumanMessage falls in the trim window

next build hangs when static generation worker batch exceeds V8 max string length

Management API logs endpoint missing source_name and failing on SELECT *

ChatDeepSeek bind_tools(tool_choice='any') produces invalid request with default thinking mode

Invalid URL / Internal Server Error in response to OPTIONS * request

cacheComponents: @vercel/otel's http instrumentation tracer acquired during register() bypasses afterRegistration span patch causing Math.random() prerender error

Mustache inverted section nested in same-key section misrenders or raises IndexError

SummarizationMiddleware fails to identify Claude on Bedrock, causing late summarization and potential context overflow

with_fallbacks(exception_key=...) writes the exception into the caller's own input mapping

Turbopack HMR WebSocket closure on first load breaks initial client-side navigation

cacheComponents: client navigation to generateStaticParams path crashes with React #412 when custom cacheHandler misses

PIIMiddleware(apply_to_output=True) blanks streaming tool call args due to JSON parse failure on partial chunks

[langchain-openai] ChatOpenAI.stream() crashes on null function in tool-call delta

Injected tool arg declared with Pydantic alias is not filtered from on_tool_start's inputs and input_str

Agentic run with dynamic filtering (web_search_20260209) fails due to missing code_execution_tool_result block

Metadata routes with `export const revalidate` are emitted as static files in adapter output, dropping revalidate on Vercel

cacheComponents: RSC and form requests to literal dynamic route URL fail with E592

Unexpected JWT invalidation causes forced logout during active editing

Sass BOM in concatenated CSS silently breaks selectors with PostCSS 8.5.24+ under webpack

RunnableSequence silently swallows exceptions in async streaming path

HumanInTheLoopMiddleware cross-tool edit bypasses target tool's interrupt_on policy

Turbopack module fragments panic when passing a plain function export from a 'use client' module as prop

openai: malformed tool calls cause all tool calls to be silently dropped

MCP tools with a parameter named "config" silently broken by LangChain's RunnableConfig injection

astream_events v2 does not emit terminal error events for failed runs

Windows: @vercel/nft emits globs outside job.base, causing EACCES junction walks

Navigation fails to scroll to top when Suspense fallback renders no DOM nodes

DNS NXDOMAIN for active Supabase project qxvnbmwhyrinsarnazkb.supabase.co

Default "use cache" handler pins Buffer pool slabs causing memory to exceed cacheMaxMemorySize by up to 22x on Node 26

Supavisor session pooler authentication failure after PostgreSQL password rotation

SummarizationMiddleware replaces history with a placeholder when no HumanMessage falls in the trim window

next build hangs when static generation worker batch exceeds V8 max string length

Management API logs endpoint missing source_name and failing on SELECT *

ChatDeepSeek bind_tools(tool_choice='any') produces invalid request with default thinking mode

Invalid URL / Internal Server Error in response to OPTIONS * request

cacheComponents: @vercel/otel's http instrumentation tracer acquired during register() bypasses afterRegistration span patch causing Math.random() prerender error

Ecosystem Topology

Agent Frameworks

Vector Databases

Toolchains

Active Intelligence Feed