{"record":{"id":"b87f90c85870826a","repo":"ruvnet/ruflo","slug":"config-path-must-be-within-current-working-directo","errorCode":null,"errorMessage":"Config path must be within current working directory","messagePattern":"Config path must be within current working directory","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/mcp/tools/config-tools.ts","lineNumber":43,"sourceCode":"    throw new Error('Absolute paths are not allowed for config files');\n  }\n  if (normalizedPath.includes('..')) {\n    throw new Error('Path traversal (..) is not allowed');\n  }\n\n  // Only allow .json and .config.* files\n  const allowedExtensions = ['.json', '.config.json', '.config.js', '.config.ts'];\n  const hasAllowedExt = allowedExtensions.some(ext => normalizedPath.endsWith(ext));\n  if (!hasAllowedExt) {\n    throw new Error('Only .json and .config.* file extensions are allowed');\n  }\n\n  // Resolve to absolute path within cwd\n  const resolvedPath = resolve(cwd, normalizedPath);\n\n  // Ensure the resolved path is within cwd\n  if (!resolvedPath.startsWith(cwd)) {\n    throw new Error('Config path must be within current working directory');\n  }\n\n  return resolvedPath;\n}\n\n// ============================================================================\n// Input Schemas\n// ============================================================================\n\nconst loadConfigSchema = z.object({\n  path: z.string().optional()\n    .describe('Configuration file path (defaults to ./claude-flow.config.json)'),\n  scope: z.enum(['global', 'project', 'user']).default('project')\n    .describe('Configuration scope'),\n  merge: z.boolean().default(true)\n    .describe('Merge with default configuration'),\n  includeDefaults: z.boolean().default(false)\n    .describe('Include default values in response'),","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/mcp/tools/config-tools.ts#L25-L61","documentation":"validateConfigPath containment guard: resolving the normalized relative path against cwd produced an absolute path outside the cwd. Defense-in-depth after the earlier checks — the final resolved location must lie within the working directory or the save/load is refused.","triggerScenarios":"Thrown at v3/mcp/tools/config-tools.ts:43 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Keep the config file inside the current working directory tree.","Change the working directory to the project that owns the config file."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}