ruvnet/ruflo · error · Error

Config path must be within current working directory

Error message

Config path must be within current working directory

What it means

validateConfigPath containment guard: resolving the normalized relative path against cwd produced an absolute path outside the cwd. Defense-in-depth after the earlier checks — the final resolved location must lie within the working directory or the save/load is refused.

Source

Thrown at v3/mcp/tools/config-tools.ts:43

    throw new Error('Absolute paths are not allowed for config files');
  }
  if (normalizedPath.includes('..')) {
    throw new Error('Path traversal (..) is not allowed');
  }

  // Only allow .json and .config.* files
  const allowedExtensions = ['.json', '.config.json', '.config.js', '.config.ts'];
  const hasAllowedExt = allowedExtensions.some(ext => normalizedPath.endsWith(ext));
  if (!hasAllowedExt) {
    throw new Error('Only .json and .config.* file extensions are allowed');
  }

  // Resolve to absolute path within cwd
  const resolvedPath = resolve(cwd, normalizedPath);

  // Ensure the resolved path is within cwd
  if (!resolvedPath.startsWith(cwd)) {
    throw new Error('Config path must be within current working directory');
  }

  return resolvedPath;
}

// ============================================================================
// Input Schemas
// ============================================================================

const loadConfigSchema = z.object({
  path: z.string().optional()
    .describe('Configuration file path (defaults to ./claude-flow.config.json)'),
  scope: z.enum(['global', 'project', 'user']).default('project')
    .describe('Configuration scope'),
  merge: z.boolean().default(true)
    .describe('Merge with default configuration'),
  includeDefaults: z.boolean().default(false)
    .describe('Include default values in response'),

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Keep the config file inside the current working directory tree.
2. Change the working directory to the project that owns the config file.

When it happens

Trigger: Thrown at v3/mcp/tools/config-tools.ts:43 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/b87f90c85870826a. Report an issue: GitHub.