{"record":{"id":"8eb841ac22976f54","repo":"mastra-ai/mastra","slug":"configdirname-must-be-a-single-directory-name-with","errorCode":null,"errorMessage":"configDirName must be a single directory name without path separators or traversal components, got: \"${configDirName}\"","messagePattern":"configDirName must be a single directory name without path separators or traversal components, got: \"(.+?)\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"mastracode/sdk/src/constants.ts","lineNumber":22,"sourceCode":"export const DEFAULT_CONFIG_DIR = '.mastracode';\n\n/**\n * Validate that a configDirName is a safe single directory name.\n * Rejects absolute paths, path separators, and traversal components.\n */\nexport function validateConfigDirName(configDirName: string): void {\n  if (configDirName.trim().length === 0) {\n    throw new Error('configDirName must be a non-empty directory name');\n  }\n\n  if (\n    path.isAbsolute(configDirName) ||\n    configDirName.includes('/') ||\n    configDirName.includes('\\\\') ||\n    configDirName === '..' ||\n    configDirName === '.'\n  ) {\n    throw new Error(\n      `configDirName must be a single directory name without path separators or traversal components, got: \"${configDirName}\"`,\n    );\n  }\n}\n\n// Default OM model - using gemini-3.5-flash for efficiency\nexport const DEFAULT_OM_MODEL_ID = process.env.DEFAULT_OM_MODEL_ID ?? 'google/gemini-3.5-flash';\n\n// Default OM thresholds — per-thread overrides are loaded from thread metadata\nexport const DEFAULT_OBS_THRESHOLD = 30_000;\nexport const DEFAULT_REF_THRESHOLD = 40_000;\n","sourceCodeStart":4,"sourceCodeEnd":34,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/mastracode/sdk/src/constants.ts#L4-L34","documentation":"validateConfigDirName() rejects configDirName values that are absolute paths, contain path separators ('/' or '\\\\'), or are traversal components ('.' or '..'). configDirName must be a single safe directory segment because the SDK joins it under a parent config directory; anything path-like could escape that directory. The thrown message echoes the offending value.","triggerScenarios":"createMastraCodeAgentController({ configDirName: ... }) with values like '/etc/mastra', 'foo/bar', 'a\\\\b', '.', or '..' — the isAbsolute/includes/== checks in the source all route to this throw.","commonSituations":"Users passing a full config path ('/home/me/.config/mastra') where only the leaf directory name is expected; Windows-style separators leaking from path building; '.' or '..' from careless defaults; joining user input with path.join before handing it to the SDK.","solutions":["Pass only the leaf directory name (e.g. '.mastra-code'), not a full or partially joined path.","Strip separators/traversal from user input before calling, e.g. take path.basename(input) or reject it yourself.","Use path.basename on absolute values to derive a safe single segment, then re-validate with validateConfigDirName if it is exported."],"exampleFix":"// before\ncreateMastraCodeAgentController({ configDirName: '/home/me/.config/mastra' });\n// after\nconst configDirName = '.mastra-code';\ncreateMastraCodeAgentController({ configDirName });","handlingStrategy":"validation","validationCode":"function isSafeDirName(v) {\n  return (\n    typeof v === 'string' &&\n    v.trim().length > 0 &&\n    !path.isAbsolute(v) &&\n    !v.includes('/') &&\n    !v.includes('\\\\') &&\n    v !== '.' && v !== '..'\n  );\n}","typeGuard":"function isSingleDirSegment(v: unknown): v is string {\n  return typeof v === 'string' && /^[^/\\\\.][^/\\\\]*$/.test(v) && v !== '..';\n}","tryCatchPattern":"try {\n  validateConfigDirName(candidate);\n} catch (err) {\n  console.error(`Invalid configDirName: ${candidate}`);\n  process.exitCode = 2;\n}","preventionTips":["Pass only the leaf directory name; construct the full path inside your app, not in configDirName.","Never pass values derived from path.join or absolute user paths.","Run validateConfigDirName (or an equivalent regex) on user input before controller creation."],"tags":["configuration","validation","path-traversal"],"backgroundTag":"invalid-config-dir-name","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T08:17:16.595Z"}