ruvnet/ruflo · error · SafeExecutorError

COMMAND_NOT_ALLOWED

COMMAND_NOT_ALLOWED

Error message

Command not in allowlist: ${command}

What it means

SafeExecutor.validateCommand could not match the requested command against any allowedCommands entry, either by full path or by basename. This is the core allowlist check firing: the executable was never approved for this executor, so execution stops before any spawn.

Source

Thrown at v3/@claude-flow/security/src/safe-executor.ts:233

  }

  /**
   * Validates a command against the allowlist.
   *
   * @param command - Command to validate
   * @throws SafeExecutorError if command is not allowed
   */
  private validateCommand(command: string): void {
    const basename = path.basename(command);

    // Check if command is allowed
    const isAllowed = this.config.allowedCommands.some(allowed => {
      const allowedBasename = path.basename(allowed);
      return command === allowed || basename === allowedBasename;
    });

    if (!isAllowed) {
      throw new SafeExecutorError(
        `Command not in allowlist: ${command}`,
        'COMMAND_NOT_ALLOWED',
        command
      );
    }

    // Check for sudo
    if (!this.config.allowSudo && (command === 'sudo' || basename === 'sudo')) {
      throw new SafeExecutorError(
        'Sudo commands are not allowed',
        'SUDO_NOT_ALLOWED',
        command
      );
    }
  }

  /**
   * Validates command arguments for injection patterns.

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Add the command to the executor allowlist if it is safe.
2. Fix the caller to use one of the allowed commands; check for typos in the command name.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/safe-executor.ts:233 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/bde1082f34fa0ac2. Report an issue: GitHub.