{"record":{"id":"b6bdcd14b08da548","repo":"OpenBMB/ChatDev","slug":"agent-node-nid-config-must-be-an-object","errorCode":null,"errorMessage":"Agent node '{nid}' config must be an object","messagePattern":"Agent node '(.+?)' config must be an object","errorType":"validation","errorClass":"DesignError","httpStatus":null,"severity":"error","filePath":"check/check.py","lineNumber":43,"sourceCode":"    if not names:\n        raise DesignError(\"No node types registered; cannot validate workflow\")\n    return names\n\n\ndef _ensure_supported(graph: Dict[str, Any]) -> None:\n    \"\"\"Ensure the MVP constraints are satisfied for the provided graph.\"\"\"\n    for node in graph.get(\"nodes\", []) or []:\n        nid = node.get(\"id\")\n        ntype = node.get(\"type\")\n        allowed = _allowed_node_types()\n        if ntype not in allowed:\n            raise DesignError(\n                f\"Unsupported node type '{ntype}' for node '{nid}'. Only {allowed} nodes are supported.\"\n            )\n        if ntype == \"agent\":\n            agent_cfg = node.get(\"config\") or {}\n            if not isinstance(agent_cfg, dict):\n                raise DesignError(f\"Agent node '{nid}' config must be an object\")\n            for legacy_key in [\"memory\"]:\n                if legacy_key in agent_cfg:\n                    raise DesignError(\n                        f\"'{legacy_key}' is deprecated. Use the new graph-level memory stores for node '{nid}'.\"\n                    )\n\n\ndef load_config(\n    config_path: Path,\n    *,\n    fn_module: Optional[str] = None,\n    set_defaults: bool = True,\n    vars_override: Optional[Dict[str, Any]] = None,\n) -> DesignConfig:\n    \"\"\"Load, validate, and sanity-check a workflow file.\"\"\"\n\n    try:\n        raw_data = read_yaml(config_path)","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/OpenBMB/ChatDev/blob/4fb2db0ea90375ce1059f44fe03ffbd191a7a169/check/check.py#L25-L61","documentation":"Defensive 400 raised when the resolved target path of the new tool file falls outside the function tools directory (the relative_to check fails). This blocks symlink or path tricks that escape the tools dir.","triggerScenarios":"Practically unreachable via the public API because the filename regex already bans slashes and dots; can trigger if FUNCTION_CALLING_DIR is a symlink and resolution normalizes it differently, or if internal code bypasses the regex.","commonSituations":"Misconfigured FUNCTION_CALLING_DIR pointing through symlinks; direct calls to the internal logic with unsanitized filenames in tests or forks.","solutions":["Verify FUNCTION_CALLING_DIR is a real, consistently resolved path.","Ensure the filename contains no path separators before calling the API.","If maintaining a fork, run the same regex sanitization before invoking the write logic."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"assert '/' not in name and '..' not in name","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only send bare filenames","Keep FUNCTION_CALLING_DIR consistent and non-symlinked"],"tags":["security","path-traversal","fastapi"],"backgroundTag":"path-traversal-blocked","analyzedSha":"4fb2db0ea90375ce1059f44fe03ffbd191a7a169","analyzedAt":"2026-08-27T14:35:29.622Z","schemaVersion":2},"datasetVersion":"2026-08-27T19:17:21.184Z"}