ComposioHQ/composio · error · ComposioFileUploadPathNotAllowedError

Refusing to auto-upload "${attempted}": no upload directorie

Error message

Refusing to auto-upload "${attempted}": no upload directories are configured.

Path attempted:   ${attempted}
Resolved to:      ${real}

Automatic file upload during tool execution is locked down by default
to prevent a prompt-injected tool from exfiltrating server files
(source code, .env, SSH keys, etc.).
${buildHelpFooter(allowlist)}

What it means

assertPathInsideUploadDirs throws ComposioFileUploadPathNotAllowedError when automatic file upload is attempted but the fileUploadDirs allowlist is empty. Auto-upload is locked down by default so a prompt-injected tool cannot exfiltrate server files (.env, source, SSH keys).

Source

Thrown at ts/packages/core/src/utils/uploadDirAllowlist.node.ts:144

        `Path attempted:   ${attempted}`,
        `Resolved to:      ${abs}`,
        `Process cwd:      ${cwd}`,
        `Parent exists:    ${parentExists ? 'yes (' + parent + ')' : 'no (' + parent + ')'}`,
        '',
        'Common causes:',
        '  - Typo in the filename passed to the tool.',
        '  - Relative path resolved against the wrong working directory',
        '    (relative paths use process.cwd() at the moment of upload).',
        '  - File was deleted between the tool being called and the upload starting.',
        '',
        buildHelpFooter(allowlist),
      ].join('\n'),
      { meta: { attempted, resolved: abs, cwd, allowlist } }
    );
  }

  if (allowlist.length === 0) {
    throw new ComposioFileUploadPathNotAllowedError(
      [
        `Refusing to auto-upload "${attempted}": no upload directories are configured.`,
        '',
        `Path attempted:   ${attempted}`,
        `Resolved to:      ${real}`,
        '',
        'Automatic file upload during tool execution is locked down by default',
        'to prevent a prompt-injected tool from exfiltrating server files',
        '(source code, .env, SSH keys, etc.).',
        buildHelpFooter(allowlist),
      ].join('\n'),
      { meta: { attempted, resolved: real, allowlist } }
    );
  }

  for (const dir of allowlist) {
    const realDir = tryRealpath(dir) ?? path.resolve(dir);
    if (isInsideDir(real, realDir)) {

View on GitHub (pinned to 64b1b85502)

Solutions

Configure fileUploadDirs in the Composio client config with the specific directories that should be uploadable (e.g. [os.tmpdir(), './uploads'])
Keep the allowlist narrow — only dedicated upload/scratch dirs, never project root or home
Alternatively disable auto-upload expectations by passing remote URLs to the tool instead of local paths

Example fix

// before
const composio = new Composio({ apiKey });
// after
const composio = new Composio({ apiKey, fileUploadDirs: [path.resolve('./uploads'), os.tmpdir()] });

Defensive patterns

Strategy: validation

Validate before calling

const cfg = composio.getConfig?.() ?? {};
// Or at construction: ensure fileUploadDirs is set if any tool takes file args

Try / catch

catch (e) { if (e instanceof ComposioFileUploadPathNotAllowedError && /no upload directories/.test(e.message)) { /* instruct: configure fileUploadDirs or pass remote URL */ } throw e; }

Prevention

Configure fileUploadDirs at client construction when using file tools
Keep the allowlist to dedicated upload directories
Prefer passing hosted URLs for files instead of local paths

When it happens

Trigger: A tool execution with a local file argument triggers getFileDataAfterUploadingToS3 while no fileUploadDirs directories are configured on the Composio client.

Common situations: First-time use of file-uploading tools in server environments; adding file tools to an agent without configuring the allowlist; upgrading to an SDK version that introduced the allowlist default.

Related errors

AI-assisted analysis of ComposioHQ/composio@64b1b85502 (2026-08-28). Data as JSON: /api/errors/865cdc54dd177532. Report an issue: GitHub.