ruvnet/ruflo · error · Error

Invalid session ID: must contain only alphanumeric character

Error message

Invalid session ID: must contain only alphanumeric characters, hyphens, and underscores

What it means

getSessionPath's validateSessionId failed: the session id contains characters outside [A-Za-z0-9_-], is longer than 128 chars, or embeds traversal patterns (.., /, \). The id is used to build a filename under the session directory, so any suspect input is rejected before path construction.

Source

Thrown at v3/mcp/tools/session-tools.ts:223

    return false;
  }
  // Additional checks for path traversal patterns
  if (sessionId.includes('..') || sessionId.includes('/') || sessionId.includes('\\')) {
    return false;
  }
  // Limit length to prevent excessive file names
  if (sessionId.length > 128) {
    return false;
  }
  return true;
}

/**
 * Get session file path with security validation
 */
function getSessionPath(sessionId: string): string {
  if (!validateSessionId(sessionId)) {
    throw new Error('Invalid session ID: must contain only alphanumeric characters, hyphens, and underscores');
  }
  const sessionDir = path.join(process.cwd(), DEFAULT_SESSION_DIR);
  const sessionPath = path.join(sessionDir, `${sessionId}.json`);

  // Ensure the resolved path is within the session directory (defense in depth)
  const resolvedPath = path.resolve(sessionPath);
  const resolvedDir = path.resolve(sessionDir);
  if (!resolvedPath.startsWith(resolvedDir + path.sep)) {
    throw new Error('Invalid session ID: path traversal detected');
  }

  return sessionPath;
}

/**
 * Ensure session directory exists
 */
async function ensureSessionDir(): Promise<void> {

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Use only alphanumeric characters, hyphens, and underscores in the session id.
2. Generate session ids with a safe generator (e.g. UUID without braces).

When it happens

Trigger: Thrown at v3/mcp/tools/session-tools.ts:223 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/5f0dddc059fb92bb. Report an issue: GitHub.