Fission-AI/OpenSpec · error · Error

Refusing to manage an artifact outside the project: ${artifa

Error message

Refusing to manage an artifact outside the project: ${artifactPath}

What it means

Error "Refusing to manage an artifact outside the project: ${artifactPath}" thrown in Fission-AI/OpenSpec.

Source

Thrown at src/utils/file-system.ts:129

   */
  static assertPathWithin(allowedDirectory: string, targetPath: string): void {
    const resolvedDirectory = path.resolve(allowedDirectory);
    const resolvedTarget = path.resolve(targetPath);

    if (!this.isPathWithin(resolvedDirectory, resolvedTarget)) {
      throw new Error(`Path is outside the allowed directory: ${targetPath}`);
    }

    const canonicalDirectory = this.canonicalizePotentialPath(resolvedDirectory);
    const canonicalTarget = this.canonicalizePotentialPath(resolvedTarget);
    if (!this.isPathWithin(canonicalDirectory, canonicalTarget)) {
      throw new Error(`Path is outside the allowed directory: ${targetPath}`);
    }
  }

  static resolveProjectArtifactPath(projectPath: string, artifactPath: string): string {
    if (path.isAbsolute(artifactPath)) {
      throw new Error(`Refusing to manage an artifact outside the project: ${artifactPath}`);
    }

    const targetPath = path.join(projectPath, artifactPath);
    this.assertPathWithin(projectPath, targetPath);
    return targetPath;
  }

  static assertProjectArtifactPath(projectPath: string, targetPath: string): void {
    this.assertPathWithin(projectPath, targetPath);
  }

  private static isPathWithin(allowedDirectory: string, targetPath: string): boolean {
    const relative = path.relative(allowedDirectory, targetPath);
    return (
      relative === '' ||
      (relative !== '..' &&
        !relative.startsWith(`..${path.sep}`) &&
        !path.isAbsolute(relative))

View on GitHub (pinned to 6926ccb18a)

When it happens

Trigger: Thrown at src/utils/file-system.ts:129 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Fission-AI/OpenSpec@6926ccb18a (2026-08-25). Data as JSON: /api/errors/9fb8d0ee4112b969. Report an issue: GitHub.