ruvnet/ruflo · error

[channel-guard] sanitized ${result.findings.length} finding(

Error message

[channel-guard] sanitized ${result.findings.length} finding(s) in inter-agent message (${result.stats.messageLength} chars, ${result.stats.scanTimeMs}ms scan)

What it means

Structured audit log from guardChannelMessage: the channel guard sanitized an inter-agent message, reporting how many findings were removed plus message length and scan time; the sanitized content, not the original, crosses the boundary.

Source

Thrown at v3/@claude-flow/hooks/src/workers/channel-guard-worker.ts:294

/** Reads `CLAUDE_FLOW_SECURITY_CHANNEL_GATE` fresh on every call. Only the literal value `'0'` disables the gate — everything else (including unset) keeps it enabled. */
export function isChannelGateEnabled(): boolean {
  return process.env[CHANNEL_GATE_ENV] !== '0';
}

/**
 * The gate itself: sanitizes `message` and logs a structured audit event
 * when findings are present, unless `CLAUDE_FLOW_SECURITY_CHANNEL_GATE=0`.
 * Call this at any point content is about to cross an inter-agent boundary.
 */
export function guardChannelMessage(message: string, options: ChannelGuardOptions = {}): ChannelGuardOutcome {
  if (!isChannelGateEnabled()) {
    return { content: message, result: null };
  }

  const { sanitized, result } = sanitizeChannelMessage(message, options);

  if (!result.safe) {
    console.warn(
      `[channel-guard] sanitized ${result.findings.length} finding(s) in inter-agent message ` +
        `(${result.stats.messageLength} chars, ${result.stats.scanTimeMs}ms scan)`,
    );
    for (const f of result.findings) {
      console.warn(`  - ${f.kind} (${f.severity}) @${f.offset}: ${f.reason}`);
    }
  }

  return { content: sanitized, result };
}

// ============================================================================
// Hook registration (HookEvent.PostTask) — opt-in, not eagerly registered
// ============================================================================

/**
 * Builds a `HookHandler` that reads `context.data` as the message body (when
 * it is a string), guards it, and surfaces any findings as `HookResult`

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Review the listed findings; sanitize or block the offending content at the source agent if these recur.

When it happens

Trigger: Thrown at v3/@claude-flow/hooks/src/workers/channel-guard-worker.ts:294 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/a6959732040a7903. Report an issue: GitHub.