ruvnet/ruflo · error · CredentialGeneratorError

INVALID_PASSWORD_LENGTH

INVALID_PASSWORD_LENGTH

Error message

Password length must be at least 16 characters

What it means

CredentialGenerator's constructor runs validateConfig() and refuses passwordLength < 16 with CredentialGeneratorError INVALID_PASSWORD_LENGTH. The floor is deliberate: the module is a security boundary for machine-generated credentials, and shorter outputs would undercut the entropy it promises.

Source

Thrown at v3/@claude-flow/security/src/credential-generator.ts:125

  constructor(config: CredentialConfig = {}) {
    this.config = {
      passwordLength: config.passwordLength ?? 32,
      apiKeyLength: config.apiKeyLength ?? 48,
      secretLength: config.secretLength ?? 64,
      passwordCharset: config.passwordCharset ??
        CHARSETS.UPPERCASE + CHARSETS.LOWERCASE + CHARSETS.DIGITS + CHARSETS.SPECIAL,
      apiKeyCharset: config.apiKeyCharset ?? CHARSETS.URL_SAFE,
    };

    this.validateConfig();
  }

  /**
   * Validates configuration parameters.
   */
  private validateConfig(): void {
    if (this.config.passwordLength < 16) {
      throw new CredentialGeneratorError(
        'Password length must be at least 16 characters',
        'INVALID_PASSWORD_LENGTH'
      );
    }

    if (this.config.apiKeyLength < 32) {
      throw new CredentialGeneratorError(
        'API key length must be at least 32 characters',
        'INVALID_API_KEY_LENGTH'
      );
    }

    if (this.config.secretLength < 32) {
      throw new CredentialGeneratorError(
        'Secret length must be at least 32 characters',
        'INVALID_SECRET_LENGTH'
      );
    }

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Set passwordLength >= 16 (24 is a comfortable choice), or omit it to use the built-in default
2. Validate numeric config from env/files before constructing, converting and clamping explicitly
3. If a shorter value is truly required for a non-security token, use a different utility — do not lower this floor

Example fix

// before
new CredentialGenerator({ passwordLength: 12 });

// after
new CredentialGenerator({ passwordLength: 24 });

const cfg = { passwordLength: Number(process.env.PW_LENGTH ?? 24) };
if (!(cfg.passwordLength >= 16)) {
  throw new Error(`passwordLength must be >= 16, got ${cfg.passwordLength}`);
}
new CredentialGenerator(cfg);

function isCredentialGeneratorError(e: unknown, code?: string): boolean {
  return e instanceof Error && e.name === 'CredentialGeneratorError'
    && (code === undefined || (e as { code?: string }).code === code);
}

try {
  return new CredentialGenerator(cfg);
} catch (e) {
  if (isCredentialGeneratorError(e, 'INVALID_PASSWORD_LENGTH')) {
    return new CredentialGenerator({ ...cfg, passwordLength: 16 });
  }
  throw e;
}

When it happens

Trigger: new CredentialGenerator({ passwordLength: 12 }) or any value below 16; a config file or env var where the length field is absent/zero and coerces low; porting settings from another generator with an 8/12-character convention.

Common situations: Legacy config copied forward with short lengths; YAML/env numeric fields parsed as strings sneaking past comparisons; someone 'tuning' length down for readability or DB column limits.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• INVALID_API_KEY_LENGTH
• INVALID_SECRET_LENGTH
• INVALID_ROUNDS
• INVALID_MIN_LENGTH
• Invalid completion type

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/066d7e13f532acbb. Report an issue: GitHub.