Fission-AI/OpenSpec · error · Error

Template ' ' for artifact ' ' points outside the schema…

Error message

Template '${artifact.template}' for artifact '${artifact.id}' points outside the schema templates directory

What it means

Path-confinement guard in templatesCommand: the template filename declared for an artifact in the schema resolves outside the schema's templates directory (via FileSystemUtils.assertPathWithin). Indicates a malicious or malformed artifact.template entry in the schema definition.

Solutions

1. Fix the template path in the schema's artifact definition to stay inside templates/
2. Remove the offending artifact or template declaration from the schema

When it happens

Trigger: Thrown at src/commands/workflow/templates.ts:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Fission-AI/OpenSpec@6926ccb18a (2026-08-25). Data as JSON: /api/errors/866f6402c94bceb1. Report an issue: GitHub.

Appendix: source

Thrown at src/commands/workflow/templates.ts:81

      source = 'project';
    } else if (isInsideDir(schemaDir, userSchemasDir)) {
      source = 'user';
    } else {
      source = 'package';
    }

    const templatesDir = path.join(schemaDir, 'templates');
    const templates: TemplateInfo[] = graph.getAllArtifacts().map((artifact) => {
      const templatePath = path.join(templatesDir, artifact.template);
      try {
        FileSystemUtils.assertPathWithin(templatesDir, templatePath);
        return {
          artifactId: artifact.id,
          templatePath: FileSystemUtils.canonicalizeExistingPath(templatePath),
          source,
        };
      } catch {
        throw new Error(
          `Template '${artifact.template}' for artifact '${artifact.id}' points outside the schema templates directory`
        );
      }
    });

    spinner?.stop();

    if (options.json) {
      const output: Record<string, { path: string; source: string }> = {};
      for (const t of templates) {
        output[t.artifactId] = { path: t.templatePath, source: t.source };
      }
      console.log(JSON.stringify(output, null, 2));
      return;
    }

    console.log(`Schema: ${schemaName}`);
    console.log(`Source: ${source}`);

View on GitHub (pinned to 6926ccb18a)