ruvnet/ruflo · error · Error

Only .json and .config.* file extensions are allowed

Error message

Only .json and .config.* file extensions are allowed

What it means

validateConfigPath extension guard: the (path- and traversal-safe) filename does not end in .json, .config.json, .config.js, or .config.ts. Only these config file formats may be read/written by the config tools, so other extensions are refused at validation time.

Source

Thrown at v3/mcp/tools/config-tools.ts:35

 * Validate and sanitize config file path to prevent path traversal
 */
function validateConfigPath(inputPath: string, cwd: string = process.cwd()): string {
  // Normalize the path to resolve .. and .
  const normalizedPath = normalize(inputPath);

  // Block absolute paths and paths with traversal
  if (normalizedPath.startsWith('/') || normalizedPath.startsWith('\\')) {
    throw new Error('Absolute paths are not allowed for config files');
  }
  if (normalizedPath.includes('..')) {
    throw new Error('Path traversal (..) is not allowed');
  }

  // Only allow .json and .config.* files
  const allowedExtensions = ['.json', '.config.json', '.config.js', '.config.ts'];
  const hasAllowedExt = allowedExtensions.some(ext => normalizedPath.endsWith(ext));
  if (!hasAllowedExt) {
    throw new Error('Only .json and .config.* file extensions are allowed');
  }

  // Resolve to absolute path within cwd
  const resolvedPath = resolve(cwd, normalizedPath);

  // Ensure the resolved path is within cwd
  if (!resolvedPath.startsWith(cwd)) {
    throw new Error('Config path must be within current working directory');
  }

  return resolvedPath;
}

// ============================================================================
// Input Schemas
// ============================================================================

const loadConfigSchema = z.object({

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Use a .json or .config.* file extension for the config file.
2. Rename the file or adjust the tool call to target an allowed extension.

When it happens

Trigger: Thrown at v3/mcp/tools/config-tools.ts:35 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/361ae0630b598485. Report an issue: GitHub.