Fission-AI/OpenSpec · error · Error

Path is outside the allowed directory: ${specPath}

Error message

Path is outside the allowed directory: ${specPath}

What it means

Error "Path is outside the allowed directory: ${specPath}" thrown in Fission-AI/OpenSpec.

Source

Thrown at src/commands/spec.ts:22

import { MarkdownParser } from '../core/parsers/markdown-parser.js';
import { Validator } from '../core/validation/validator.js';
import type { Spec } from '../core/schemas/index.js';
import type { RootOutput } from '../core/root-selection.js';
import { isInteractive } from '../utils/interactive.js';
import { getSpecIds } from '../utils/item-discovery.js';
import { discoverSpecFiles } from '../utils/spec-discovery.js';
import { FileSystemUtils } from '../utils/file-system.js';

const SPECS_DIR = 'openspec/specs';

function assertSpecPath(specsDir: string, specPath: string): void {
  const relativePath = path.relative(path.resolve(specsDir), path.resolve(specPath));
  if (
    relativePath === '..' ||
    relativePath.startsWith(`..${path.sep}`) ||
    path.isAbsolute(relativePath)
  ) {
    throw new Error(`Path is outside the allowed directory: ${specPath}`);
  }

  try {
    // Preserve confined spec.md links, including links to a sibling capability.
    FileSystemUtils.assertPathWithin(specsDir, specPath);
  } catch {
    // A capability directory may intentionally be a monorepo symlink. Treat it
    // as the trust root while still rejecting a link outside that capability.
    FileSystemUtils.assertPathWithin(path.dirname(specPath), specPath);
  }
}

interface ShowOptions {
  json?: boolean;
  // JSON-only filters (raw-first text has no filters)
  requirements?: boolean;
  scenarios?: boolean; // --no-scenarios sets this to false (JSON only)
  requirement?: string; // JSON only

View on GitHub (pinned to 6926ccb18a)

When it happens

Trigger: Thrown at src/commands/spec.ts:22 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Fission-AI/OpenSpec@6926ccb18a (2026-08-25). Data as JSON: /api/errors/e8a26f05cdbddbc1. Report an issue: GitHub.