Fission-AI/OpenSpec · error

Path is outside the allowed directory: ${specPath}

Error message

Path is outside the allowed directory: ${specPath}

What it means

Error "Path is outside the allowed directory: ${specPath}" thrown in Fission-AI/OpenSpec.

Source

Thrown at src/core/specs-apply.ts:59

  exists: boolean;
}

function isLexicallyWithin(allowedDirectory: string, targetPath: string): boolean {
  const relative = path.relative(path.resolve(allowedDirectory), path.resolve(targetPath));
  return (
    relative === '' ||
    (relative !== '..' &&
      !relative.startsWith(`..${path.sep}`) &&
      !path.isAbsolute(relative))
  );
}

function resolveTrustedSpecPath(specsRoot: string, specPath: string): {
  root: string;
  file: string;
} {
  if (!isLexicallyWithin(specsRoot, specPath)) {
    throw new Error(`Path is outside the allowed directory: ${specPath}`);
  }

  try {
    // Preserve spec.md links that remain inside the overall specs tree.
    FileSystemUtils.assertPathWithin(specsRoot, specPath);
    const root = FileSystemUtils.canonicalizeExistingPath(specsRoot);
    return {
      root,
      // Rebase onto the canonical root so missing targets also work when the
      // project is reached through an OS path alias (for example /var on macOS).
      file: path.join(root, path.relative(path.resolve(specsRoot), path.resolve(specPath))),
    };
  } catch {
    // Direct capability directories may intentionally be monorepo symlinks.
    // Freeze their canonical location as the trust root so later swaps are
    // rejected while a nested spec.md link still cannot escape.
    const root = FileSystemUtils.canonicalizeExistingPath(path.dirname(specPath));
    const file = path.join(root, path.basename(specPath));

View on GitHub (pinned to 6926ccb18a)

When it happens

Trigger: Thrown at src/core/specs-apply.ts:59 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Fission-AI/OpenSpec@6926ccb18a (2026-08-25). Data as JSON: /api/errors/1a22f74613f12778. Report an issue: GitHub.