Fission-AI/OpenSpec · error · Error

Path is outside the allowed directory: ${targetPath}

Error message

Path is outside the allowed directory: ${targetPath}

What it means

Error "Path is outside the allowed directory: ${targetPath}" thrown in Fission-AI/OpenSpec.

Source

Thrown at src/utils/file-system.ts:117

      try {
        return nodeFs.realpathSync(targetPath);
      } catch {
        return path.resolve(targetPath);
      }
    }
  }

  /**
   * Refuses a target that leaves an allowed directory, including through an
   * existing symlink in either the target or one of its parent directories.
   * Missing suffixes are resolved from their nearest existing ancestor.
   */
  static assertPathWithin(allowedDirectory: string, targetPath: string): void {
    const resolvedDirectory = path.resolve(allowedDirectory);
    const resolvedTarget = path.resolve(targetPath);

    if (!this.isPathWithin(resolvedDirectory, resolvedTarget)) {
      throw new Error(`Path is outside the allowed directory: ${targetPath}`);
    }

    const canonicalDirectory = this.canonicalizePotentialPath(resolvedDirectory);
    const canonicalTarget = this.canonicalizePotentialPath(resolvedTarget);
    if (!this.isPathWithin(canonicalDirectory, canonicalTarget)) {
      throw new Error(`Path is outside the allowed directory: ${targetPath}`);
    }
  }

  static resolveProjectArtifactPath(projectPath: string, artifactPath: string): string {
    if (path.isAbsolute(artifactPath)) {
      throw new Error(`Refusing to manage an artifact outside the project: ${artifactPath}`);
    }

    const targetPath = path.join(projectPath, artifactPath);
    this.assertPathWithin(projectPath, targetPath);
    return targetPath;
  }

View on GitHub (pinned to 6926ccb18a)

When it happens

Trigger: Thrown at src/utils/file-system.ts:117 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Fission-AI/OpenSpec@6926ccb18a (2026-08-25). Data as JSON: /api/errors/35f5bc9b0b9b7c7a. Report an issue: GitHub.