ruvnet/ruflo · error

Path validation failed: ${pathResult.error}

Error message

Path validation failed: ${pathResult.error}

What it means

security-scan handler ran the target path through the security module's pathValidator and it returned invalid, with the validator's reason interpolated into this error. The scan refuses to proceed on a path that fails path validation (traversal, permission, or nonexistence).

Source

Thrown at v3/plugins/agentic-qe/src/tools/security-compliance/security-scan.ts:156

 */
export async function handler(
  input: SecurityScanInput,
  context: ToolContext
): Promise<{ content: Array<{ type: 'text'; text: string }> }> {
  const startTime = Date.now();

  try {
    // Validate input
    const validatedInput = SecurityScanInputSchema.parse(input);

    // Get security module from context for path validation
    const securityModule = context.get<{ pathValidator: { validate: (p: string) => Promise<{ valid: boolean; error?: string; resolvedPath: string }> } }>('security');

    // Validate target path if security module available
    if (securityModule) {
      const pathResult = await securityModule.pathValidator.validate(validatedInput.targetPath);
      if (!pathResult.valid) {
        throw new Error(`Path validation failed: ${pathResult.error}`);
      }
    }

    // Perform SAST scan
    let sastFindings: SecurityFinding[] = [];
    if (validatedInput.scanType === 'sast' || validatedInput.scanType === 'both') {
      sastFindings = await performSASTScan(
        validatedInput.targetPath,
        validatedInput.scanDepth,
        validatedInput.excludePatterns
      );
    }

    // Perform DAST scan
    let dastFindings: SecurityFinding[] = [];
    if ((validatedInput.scanType === 'dast' || validatedInput.scanType === 'both') && validatedInput.targetUrl) {
      dastFindings = await performDASTScan(validatedInput.targetUrl, validatedInput.scanDepth);
    }

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Inspect the underlying cause in logs, fix the root issue, and retry the operation.
2. Validate inputs and preconditions before invoking this code path so the error is avoided.

When it happens

Trigger: Thrown at v3/plugins/agentic-qe/src/tools/security-compliance/security-scan.ts:156 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/76e6b79f8a256720. Report an issue: GitHub.