ruvnet/ruflo · error · Error

WgMeshService.formatCmd: refusing arg with unsafe chars: ${J

Error message

WgMeshService.formatCmd: refusing arg with unsafe chars: ${JSON.stringify(args)}

What it means

Defense-in-depth guard inside WgMeshService.formatCmd: a string destined for a shell command (wg key material, mesh IPs, fixed verbs) contains characters outside the allowed set (base64 pubkey chars [A-Za-z0-9+/=], IPv4 chars [0-9./], and known verbs). The command is refused rather than shipping a substring that could escape its argument slot and inject shell syntax.

Source

Thrown at v3/@claude-flow/plugin-agent-federation/src/domain/services/wg-mesh-service.ts:343

          meshIP,
          endpoint,
          publicKey: pubkey,
          state,
          allowedIPs: safe && state === 'active' ? this.computeAllowedIPs(peer, safe.wgMeshIP) : [],
        };
      });
  }

  /**
   * Defense-in-depth: validate that all bits we splice into a shell
   * command are alphanumeric / base64 / WG-allowed chars. Refuses the
   * command rather than ship a substring that might escape its slot.
   */
  private formatCmd(args: string): string {
    // Allow: base64 pubkey chars [A-Za-z0-9+/=], IPv4 mesh chars
    // [0-9./], plus a handful of fixed verbs. Reject everything else.
    if (!/^[A-Za-z0-9+/=., "/-]*$/.test(args)) {
      throw new Error(`WgMeshService.formatCmd: refusing arg with unsafe chars: ${JSON.stringify(args)}`);
    }
    return `wg set ${this.interfaceName} ${args}`;
  }
}

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Validate WireGuard args (keys are base64, endpoints are host:port) before formatting commands.
2. Use execFile-style argument arrays instead of string-formatted shell commands to avoid injection.

When it happens

Trigger: formatCmd refuses to build a shell command because an argument contains unsafe characters.

Common situations: Interface names, keys, or endpoints containing shell metacharacters or whitespace reach command formatting.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/716b1fa23b87f516. Report an issue: GitHub.