ruvnet/ruflo · error · SafeExecutorError

EMPTY_ALLOWLIST

EMPTY_ALLOWLIST

Error message

At least one allowed command must be specified

What it means

SafeExecutor config validation (EMPTY_ALLOWLIST): the constructor was given an allowedCommands array with zero entries. An allowlist-based executor with an empty allowlist would either block everything or, worse, be tempted to bypass checks, so construction fails fast.

Source

Thrown at v3/@claude-flow/security/src/safe-executor.ts:198

      pattern => new RegExp(this.escapeRegExp(pattern), 'i')
    );

    this.validateConfig();
  }

  /**
   * Escapes special regex characters.
   */
  private escapeRegExp(str: string): string {
    return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
  }

  /**
   * Validates executor configuration.
   */
  private validateConfig(): void {
    if (this.config.allowedCommands.length === 0) {
      throw new SafeExecutorError(
        'At least one allowed command must be specified',
        'EMPTY_ALLOWLIST'
      );
    }

    // Check for dangerous commands in allowlist
    const dangerousAllowed = this.config.allowedCommands.filter(
      cmd => DANGEROUS_COMMANDS.includes(path.basename(cmd))
    );

    if (dangerousAllowed.length > 0) {
      throw new SafeExecutorError(
        `Dangerous commands cannot be allowed: ${dangerousAllowed.join(', ')}`,
        'DANGEROUS_COMMAND_ALLOWED'
      );
    }
  }

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Pass a non-empty allowedCommands array when constructing the SafeExecutor.
2. Load the allowlist from configuration and fail fast at startup if it is empty.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/safe-executor.ts:198 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/dd014f721892ccc1. Report an issue: GitHub.