{"record":{"id":"1a22f74613f12778","repo":"Fission-AI/OpenSpec","slug":"path-is-outside-the-allowed-directory-specpath-1a22f7","errorCode":null,"errorMessage":"Path is outside the allowed directory: ${specPath}","messagePattern":"Path is outside the allowed directory: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/core/specs-apply.ts","lineNumber":59,"sourceCode":"  exists: boolean;\n}\n\nfunction isLexicallyWithin(allowedDirectory: string, targetPath: string): boolean {\n  const relative = path.relative(path.resolve(allowedDirectory), path.resolve(targetPath));\n  return (\n    relative === '' ||\n    (relative !== '..' &&\n      !relative.startsWith(`..${path.sep}`) &&\n      !path.isAbsolute(relative))\n  );\n}\n\nfunction resolveTrustedSpecPath(specsRoot: string, specPath: string): {\n  root: string;\n  file: string;\n} {\n  if (!isLexicallyWithin(specsRoot, specPath)) {\n    throw new Error(`Path is outside the allowed directory: ${specPath}`);\n  }\n\n  try {\n    // Preserve spec.md links that remain inside the overall specs tree.\n    FileSystemUtils.assertPathWithin(specsRoot, specPath);\n    const root = FileSystemUtils.canonicalizeExistingPath(specsRoot);\n    return {\n      root,\n      // Rebase onto the canonical root so missing targets also work when the\n      // project is reached through an OS path alias (for example /var on macOS).\n      file: path.join(root, path.relative(path.resolve(specsRoot), path.resolve(specPath))),\n    };\n  } catch {\n    // Direct capability directories may intentionally be monorepo symlinks.\n    // Freeze their canonical location as the trust root so later swaps are\n    // rejected while a nested spec.md link still cannot escape.\n    const root = FileSystemUtils.canonicalizeExistingPath(path.dirname(specPath));\n    const file = path.join(root, path.basename(specPath));","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/Fission-AI/OpenSpec/blob/6926ccb18afa4ff621112813e9968334576ee11a/src/core/specs-apply.ts#L41-L77","documentation":"Error \"Path is outside the allowed directory: ${specPath}\" thrown in Fission-AI/OpenSpec.","triggerScenarios":"Thrown at src/core/specs-apply.ts:59 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6926ccb18afa4ff621112813e9968334576ee11a","analyzedAt":"2026-08-25T12:29:45.729Z","schemaVersion":2},"datasetVersion":"2026-08-25T16:17:27.014Z"}