BigPizzaV3/CodexPlusPlus · error · anyhow::Error

Dream Skin path must not be a symbolic link

Error message

Dream Skin path must not be a symbolic link

What it means

Security guard in reject_symlink: symlink_metadata on a Dream Skin path shows a symlink, which the library refuses to follow to prevent path-traversal attacks (a symlinked theme path could point outside the state directory). Fires when saving, validating, or replacing a theme through a symbolic link.

Source

Thrown at crates/codex-plus-core/src/dream_skin_library.rs:663

fn remove_known_theme_directory(directory: &Path) -> anyhow::Result<()> {
    if !directory.exists() {
        return Ok(());
    }
    ensure_known_theme_directory(directory)?;
    for entry in std::fs::read_dir(directory)? {
        let path = entry?.path();
        std::fs::remove_file(&path)
            .with_context(|| format!("failed to remove {}", path.display()))?;
    }
    std::fs::remove_dir(directory)
        .with_context(|| format!("failed to remove {}", directory.display()))?;
    Ok(())
}

fn reject_symlink(path: &Path) -> anyhow::Result<()> {
    let metadata = std::fs::symlink_metadata(path)?;
    if metadata.file_type().is_symlink() {
        bail!("Dream Skin path must not be a symbolic link");
    }
    Ok(())
}

fn summary_from_draft(
    draft: &DreamSkinThemeDraft,
    active: bool,
    modified: bool,
) -> DreamSkinThemeSummary {
    DreamSkinThemeSummary {
        key: format!("stored:{}", draft.config.id),
        id: draft.config.id.clone(),
        name: draft.config.name.clone(),
        preview_path: draft.image_path.clone(),
        kind: DreamSkinThemeKind::Stored,
        builtin: false,
        active,
        modified,

View on GitHub (pinned to f2074595a2)

Solutions

1. Remove the symlink and use a real directory/file at that path
2. Move the actual theme data to the expected location instead of linking it

When it happens

Trigger: Thrown at crates/codex-plus-core/src/dream_skin_library.rs:663 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BigPizzaV3/CodexPlusPlus@f2074595a2 (2026-08-23). Data as JSON: /api/errors/b3772d2dd8114418. Report an issue: GitHub.