{"record":{"id":"48e2a09a8ec70909","repo":"ruvnet/ruflo","slug":"invalid-embedding-model-name-embeddingmodel","errorCode":null,"errorMessage":"Invalid embedding model name: ${embeddingModel}","messagePattern":"Invalid embedding model name: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/commands/init.ts","lineNumber":814,"sourceCode":"      }\n\n      output.writeln();\n      output.printSuccess('All services started');\n    }\n\n    // Handle --with-embeddings\n    const withEmbeddings = ctx.flags['with-embeddings'] || ctx.flags.withEmbeddings;\n    const embeddingModel = (ctx.flags['embedding-model'] || ctx.flags.embeddingModel || 'Xenova/all-MiniLM-L6-v2') as string;\n\n    if (withEmbeddings) {\n      output.writeln();\n      output.printInfo('Initializing ONNX embedding subsystem...');\n\n      const { execFileSync: execFileInit } = await import('child_process');\n\n      // Validate embeddingModel: must match pattern org/model-name (CRIT-02)\n      if (!/^[a-zA-Z0-9_-]+\\/[a-zA-Z0-9._-]+$/.test(embeddingModel)) {\n        throw new Error(`Invalid embedding model name: ${embeddingModel}`);\n      }\n\n      try {\n        output.writeln(output.dim(`  Model: ${embeddingModel}`));\n        output.writeln(output.dim('  Hyperbolic: Enabled (Poincaré ball)'));\n        // #2770: On Windows, `npx` ships as `npx.cmd`; execFileSync cannot spawn\n        // a .cmd file without going through cmd.exe. Enable shell on win32 so\n        // cmd.exe resolves the .cmd extension. POSIX keeps shell:false.\n        // NOTE: shell:true joins args by spaces and passes to cmd.exe — the args\n        // here are hard-coded flags + an npm package name pre-validated against\n        // /^[a-zA-Z0-9_-]+\\/[a-zA-Z0-9._-]+$/, so no injection risk. If\n        // user-controlled args are ever added, escape them before spawn.\n        execFileInit('npx', [\n          '@claude-flow/cli@latest', 'embeddings', 'init',\n          '--model', embeddingModel,\n          '--no-download', '--force',\n        ], {\n          stdio: 'pipe',","sourceCodeStart":796,"sourceCodeEnd":832,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/commands/init.ts#L796-L832","documentation":"Thrown during non-interactive init (the --with-embeddings flag path) when the embedding model name does not match the required pattern /^[a-zA-Z0-9_-]+\\/[a-zA-Z0-9._-]+$/. The model must be in HuggingFace-style 'org/model-name' format. This validation exists as a security measure (CRIT-02) because the model name is later passed to npx/execFileSync, and the regex prevents shell injection through the model argument.","triggerScenarios":"Passing --embedding-model with a value that lacks a slash (e.g. 'all-MiniLM-L6-v2'), contains spaces, or contains shell-unsafe characters. For example: --embedding-model 'my model', --embedding-model 'org/model;rm', or --embedding-model 'model'.","commonSituations":"A user passed only the model name without the organization prefix; a custom model path was used instead of an org/model identifier; the flag value was copy-pasted from a URL that included query parameters.","solutions":["Use the full org/model format: --embedding-model 'Xenova/all-MiniLM-L6-v2'","Omit the flag entirely to use the default 'Xenova/all-MiniLM-L6-v2'","Ensure the model name contains exactly one slash separating org and model-name, with no spaces or special characters beyond [a-zA-Z0-9._-]"],"exampleFix":"# before\nnpx @claude-flow/cli@latest init --with-embeddings --embedding-model 'all-MiniLM-L6-v2'\n\n# after\nnpx @claude-flow/cli@latest init --with-embeddings --embedding-model 'Xenova/all-MiniLM-L6-v2'","handlingStrategy":"validation","validationCode":"const EMBEDDING_MODEL_RE = /^[a-zA-Z0-9_-]+\\/[a-zA-Z0-9._-]+$/;\nfunction isValidEmbeddingModel(name: string): boolean {\n  return EMBEDDING_MODEL_RE.test(name);\n}\n\nconst model = ctx.flags['embedding-model'] || 'Xenova/all-MiniLM-L6-v2';\nif (!isValidEmbeddingModel(model)) {\n  throw new Error(`Invalid embedding model name: ${model}`);\n}","typeGuard":"function isValidEmbeddingModelName(s: string): boolean {\n  return /^[a-zA-Z0-9_-]+\\/[a-zA-Z0-9._-]+$/.test(s);\n}","tryCatchPattern":"try {\n  // init command throws directly — wrap if calling programmatically\n  await initCommand.action(ctx);\n} catch (e) {\n  if (e instanceof Error && e.message.includes('Invalid embedding model name')) {\n    // Use a valid org/model name\n    ctx.flags['embedding-model'] = 'Xenova/all-MiniLM-L6-v2';\n  }\n}","preventionTips":["Always use org/model format (e.g. 'Xenova/all-MiniLM-L6-v2')","Omit --embedding-model to use the default","Avoid spaces, semicolons, and special characters in model names"],"tags":["init","embeddings","validation","security","injection-prevention"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}