{"record":{"id":"a6959732040a7903","repo":"ruvnet/ruflo","slug":"channel-guard-sanitized-result-findings-length","errorCode":null,"errorMessage":"[channel-guard] sanitized ${result.findings.length} finding(s) in inter-agent message (${result.stats.messageLength} chars, ${result.stats.scanTimeMs}ms scan)","messagePattern":"\\[channel-guard\\] sanitized (.+?) finding\\(s\\) in inter-agent message \\((.+?) chars, (.+?)ms scan\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/hooks/src/workers/channel-guard-worker.ts","lineNumber":294,"sourceCode":"/** Reads `CLAUDE_FLOW_SECURITY_CHANNEL_GATE` fresh on every call. Only the literal value `'0'` disables the gate — everything else (including unset) keeps it enabled. */\nexport function isChannelGateEnabled(): boolean {\n  return process.env[CHANNEL_GATE_ENV] !== '0';\n}\n\n/**\n * The gate itself: sanitizes `message` and logs a structured audit event\n * when findings are present, unless `CLAUDE_FLOW_SECURITY_CHANNEL_GATE=0`.\n * Call this at any point content is about to cross an inter-agent boundary.\n */\nexport function guardChannelMessage(message: string, options: ChannelGuardOptions = {}): ChannelGuardOutcome {\n  if (!isChannelGateEnabled()) {\n    return { content: message, result: null };\n  }\n\n  const { sanitized, result } = sanitizeChannelMessage(message, options);\n\n  if (!result.safe) {\n    console.warn(\n      `[channel-guard] sanitized ${result.findings.length} finding(s) in inter-agent message ` +\n        `(${result.stats.messageLength} chars, ${result.stats.scanTimeMs}ms scan)`,\n    );\n    for (const f of result.findings) {\n      console.warn(`  - ${f.kind} (${f.severity}) @${f.offset}: ${f.reason}`);\n    }\n  }\n\n  return { content: sanitized, result };\n}\n\n// ============================================================================\n// Hook registration (HookEvent.PostTask) — opt-in, not eagerly registered\n// ============================================================================\n\n/**\n * Builds a `HookHandler` that reads `context.data` as the message body (when\n * it is a string), guards it, and surfaces any findings as `HookResult`","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/hooks/src/workers/channel-guard-worker.ts#L276-L312","documentation":"Structured audit log from guardChannelMessage: the channel guard sanitized an inter-agent message, reporting how many findings were removed plus message length and scan time; the sanitized content, not the original, crosses the boundary.","triggerScenarios":"Thrown at v3/@claude-flow/hooks/src/workers/channel-guard-worker.ts:294 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Review the listed findings; sanitize or block the offending content at the source agent if these recur."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}