ruvnet/ruflo · error · SafeExecutorError

DANGEROUS_COMMAND

DANGEROUS_COMMAND

Error message

Cannot allow dangerous command: ${command}

What it means

Runtime allowlist extension refused: allowCommand was asked to approve a command whose basename appears in DANGEROUS_COMMANDS. The static constructor check is enforced identically at runtime, so an inherently dangerous executable cannot be allowed into the allowlist after the executor is built.

Source

Thrown at v3/@claude-flow/security/src/safe-executor.ts:451

    return {
      process: childProcess,
      stdout: childProcess.stdout,
      stderr: childProcess.stderr,
      promise,
    };
  }

  /**
   * Adds a command to the allowlist at runtime.
   *
   * @param command - Command to add
   */
  allowCommand(command: string): void {
    const basename = path.basename(command);

    if (DANGEROUS_COMMANDS.includes(basename)) {
      throw new SafeExecutorError(
        `Cannot allow dangerous command: ${command}`,
        'DANGEROUS_COMMAND'
      );
    }

    if (!this.config.allowedCommands.includes(command)) {
      this.config.allowedCommands.push(command);
    }
  }

  /**
   * Checks if a command is allowed.
   *
   * @param command - Command to check
   * @returns True if command is allowed
   */
  isCommandAllowed(command: string): boolean {
    const basename = path.basename(command);

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Remove the dangerous command from the allowlist entry being added.
2. Use a safe alternative command that accomplishes the same task.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/safe-executor.ts:451 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/883156f086d3996e. Report an issue: GitHub.