ruvnet/ruflo · error · Error

Invalid embedding model name: ${embeddingModel}

Error message

Invalid embedding model name: ${embeddingModel}

What it means

Thrown during non-interactive init (the --with-embeddings flag path) when the embedding model name does not match the required pattern /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9._-]+$/. The model must be in HuggingFace-style 'org/model-name' format. This validation exists as a security measure (CRIT-02) because the model name is later passed to npx/execFileSync, and the regex prevents shell injection through the model argument.

Source

Thrown at v3/@claude-flow/cli/src/commands/init.ts:814

      }

      output.writeln();
      output.printSuccess('All services started');
    }

    // Handle --with-embeddings
    const withEmbeddings = ctx.flags['with-embeddings'] || ctx.flags.withEmbeddings;
    const embeddingModel = (ctx.flags['embedding-model'] || ctx.flags.embeddingModel || 'Xenova/all-MiniLM-L6-v2') as string;

    if (withEmbeddings) {
      output.writeln();
      output.printInfo('Initializing ONNX embedding subsystem...');

      const { execFileSync: execFileInit } = await import('child_process');

      // Validate embeddingModel: must match pattern org/model-name (CRIT-02)
      if (!/^[a-zA-Z0-9_-]+\/[a-zA-Z0-9._-]+$/.test(embeddingModel)) {
        throw new Error(`Invalid embedding model name: ${embeddingModel}`);
      }

      try {
        output.writeln(output.dim(`  Model: ${embeddingModel}`));
        output.writeln(output.dim('  Hyperbolic: Enabled (Poincaré ball)'));
        // #2770: On Windows, `npx` ships as `npx.cmd`; execFileSync cannot spawn
        // a .cmd file without going through cmd.exe. Enable shell on win32 so
        // cmd.exe resolves the .cmd extension. POSIX keeps shell:false.
        // NOTE: shell:true joins args by spaces and passes to cmd.exe — the args
        // here are hard-coded flags + an npm package name pre-validated against
        // /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9._-]+$/, so no injection risk. If
        // user-controlled args are ever added, escape them before spawn.
        execFileInit('npx', [
          '@claude-flow/cli@latest', 'embeddings', 'init',
          '--model', embeddingModel,
          '--no-download', '--force',
        ], {
          stdio: 'pipe',

View on GitHub (pinned to 6b01dc5a68)

Solutions

  1. Use the full org/model format: --embedding-model 'Xenova/all-MiniLM-L6-v2'
  2. Omit the flag entirely to use the default 'Xenova/all-MiniLM-L6-v2'
  3. Ensure the model name contains exactly one slash separating org and model-name, with no spaces or special characters beyond [a-zA-Z0-9._-]

Example fix

# before
npx @claude-flow/cli@latest init --with-embeddings --embedding-model 'all-MiniLM-L6-v2'

# after
npx @claude-flow/cli@latest init --with-embeddings --embedding-model 'Xenova/all-MiniLM-L6-v2'
Defensive patterns

Strategy: validation

Validate before calling

const EMBEDDING_MODEL_RE = /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9._-]+$/;
function isValidEmbeddingModel(name: string): boolean {
  return EMBEDDING_MODEL_RE.test(name);
}

const model = ctx.flags['embedding-model'] || 'Xenova/all-MiniLM-L6-v2';
if (!isValidEmbeddingModel(model)) {
  throw new Error(`Invalid embedding model name: ${model}`);
}

Type guard

function isValidEmbeddingModelName(s: string): boolean {
  return /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9._-]+$/.test(s);
}

Try / catch

try {
  // init command throws directly — wrap if calling programmatically
  await initCommand.action(ctx);
} catch (e) {
  if (e instanceof Error && e.message.includes('Invalid embedding model name')) {
    // Use a valid org/model name
    ctx.flags['embedding-model'] = 'Xenova/all-MiniLM-L6-v2';
  }
}

Prevention

When it happens

Trigger: Passing --embedding-model with a value that lacks a slash (e.g. 'all-MiniLM-L6-v2'), contains spaces, or contains shell-unsafe characters. For example: --embedding-model 'my model', --embedding-model 'org/model;rm', or --embedding-model 'model'.

Common situations: A user passed only the model name without the organization prefix; a custom model path was used instead of an org/model identifier; the flag value was copy-pasted from a URL that included query parameters.

Related errors


AI-assisted analysis of ruvnet/ruflo@6b01dc5a68 (2026-08-12). Data as JSON: /api/errors/48e2a09a8ec70909. Report an issue: GitHub.