{"record":{"id":"060a1a9bd1861e9e","repo":"Yeachan-Heo/oh-my-codex","slug":"mode-must-not-contain-path-separators","errorCode":null,"errorMessage":"mode must not contain path separators","messagePattern":"mode must not contain path separators","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/mcp/state-paths.ts","lineNumber":142,"sourceCode":"    throw new Error('session_id must match ^[A-Za-z0-9_-]{1,64}$');\n  }\n  return sessionId;\n}\n\n\nexport function validateStateModeSegment(mode: unknown): string {\n  if (typeof mode !== 'string') {\n    throw new Error('mode must be a string');\n  }\n  const normalized = mode.trim();\n  if (!normalized) {\n    throw new Error('mode must be a non-empty string');\n  }\n  if (normalized.includes('..')) {\n    throw new Error('mode must not contain \"..\"');\n  }\n  if (normalized.includes('/') || normalized.includes('\\\\')) {\n    throw new Error('mode must not contain path separators');\n  }\n  if (!STATE_MODE_SEGMENT_PATTERN.test(normalized)) {\n    throw new Error('mode must match ^[A-Za-z0-9_-]{1,64}$');\n  }\n  return normalized;\n}\n\nexport function getStateFilename(mode: string): string {\n  return `${validateStateModeSegment(mode)}${STATE_FILE_SUFFIX}`;\n}\n\nexport function validateStateFileName(fileName: unknown): string {\n  if (typeof fileName !== 'string') {\n    throw new Error('fileName must be a string');\n  }\n  const normalized = fileName.trim();\n  if (!normalized) {\n    throw new Error('fileName must be a non-empty string');","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/Yeachan-Heo/oh-my-codex/blob/3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2/src/mcp/state-paths.ts#L124-L160","documentation":"Thrown when the mode string contains a forward slash or backslash. Mode is used as a single filename segment, so path separators would create (or traverse into) subdirectories of the state directory.","triggerScenarios":"mode: \"team/night\", mode: \"a\\\\b\", or Windows-style values copied from paths.","commonSituations":"Passing a relative file path where a mode name is expected; config keys derived from paths; backslashes on Windows clients.","solutions":["Pass just the leaf segment name: \"night\" instead of \"team/night\"","Replace separators with hyphens: mode.replace(/[\\\\/]+/g, \"-\")","Keep mode values as simple slugs"],"exampleFix":"// before\ngetStateFilename(\"team/night\");\n// after\ngetStateFilename(\"team-night\");","handlingStrategy":"validation","validationCode":"mode = mode.replace(/[\\\\/]+/g, '-');","typeGuard":"function isSingleSegment(v: string): boolean { return !/[\\\\/]/.test(v); }","tryCatchPattern":null,"preventionTips":["Pass leaf names, not paths","basename() any path-like value before use"],"tags":["path-validation","security","state","mcp"],"backgroundTag":"path-separator-in-segment","analyzedSha":"3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2","analyzedAt":"2026-08-27T22:18:39.783Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}