ruvnet/ruflo · error · SafeExecutorError

SUDO_NOT_ALLOWED

SUDO_NOT_ALLOWED

Error message

Sudo commands are not allowed

What it means

SafeExecutor.validateCommand matched the command to the allowlist but it is 'sudo' and config.allowSudo is false. Privilege escalation via the executor is explicitly opted out of, so even an allowlisted sudo invocation is refused.

Source

Thrown at v3/@claude-flow/security/src/safe-executor.ts:242

    const basename = path.basename(command);

    // Check if command is allowed
    const isAllowed = this.config.allowedCommands.some(allowed => {
      const allowedBasename = path.basename(allowed);
      return command === allowed || basename === allowedBasename;
    });

    if (!isAllowed) {
      throw new SafeExecutorError(
        `Command not in allowlist: ${command}`,
        'COMMAND_NOT_ALLOWED',
        command
      );
    }

    // Check for sudo
    if (!this.config.allowSudo && (command === 'sudo' || basename === 'sudo')) {
      throw new SafeExecutorError(
        'Sudo commands are not allowed',
        'SUDO_NOT_ALLOWED',
        command
      );
    }
  }

  /**
   * Validates command arguments for injection patterns.
   *
   * @param args - Arguments to validate
   * @throws SafeExecutorError if arguments contain dangerous patterns
   */
  private validateArguments(args: string[]): void {
    for (const arg of args) {
      // Check for null bytes
      if (arg.includes('\0')) {
        throw new SafeExecutorError(

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Remove sudo from the command; run the process with the required privileges instead.
2. Use a narrowly-scoped privilege mechanism (capabilities, setuid wrapper) outside the executor.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/safe-executor.ts:242 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/94b4fe956bc9079c. Report an issue: GitHub.