{"record":{"id":"1d4a579459e13047","repo":"different-ai/openwork","slug":"file-not-found","errorCode":"file_not_found","errorMessage":"File was not found inside an authorized workspace root.","messagePattern":"File was not found inside an authorized workspace root\\.","errorType":"http","errorClass":"ApiError","httpStatus":404,"severity":"error","filePath":"apps/server/src/extensions/cloud-uploads.ts","lineNumber":145,"sourceCode":"    if (!roots.some((root) => isWithinRoot(candidate, root))) continue;\n    try {\n      const realCandidate = await realpath(candidate);\n      if (!realRoots.some((root) => isWithinRoot(realCandidate, root))) continue;\n      const info = await stat(realCandidate);\n      if (!info.isFile()) continue;\n      if (info.size < 1 || info.size > DIRECT_UPLOAD_MAX_BYTES) {\n        throw new ApiError(413, \"file_too_large\", `Direct uploads support files up to ${DIRECT_UPLOAD_MAX_BYTES} bytes.`, {\n          size: info.size,\n          maxBytes: DIRECT_UPLOAD_MAX_BYTES,\n        });\n      }\n      return realCandidate;\n    } catch (error) {\n      if (isRecord(error) && error.code === \"ENOENT\") continue;\n      throw error;\n    }\n  }\n  throw new ApiError(404, \"file_not_found\", \"File was not found inside an authorized workspace root.\", { path: requested });\n}\n\nfunction mimeTypeForPath(path: string) {\n  const lower = path.toLowerCase();\n  if (lower.endsWith(\".pdf\")) return \"application/pdf\";\n  if (lower.endsWith(\".docx\")) return \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\";\n  if (lower.endsWith(\".xlsx\")) return \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\";\n  if (lower.endsWith(\".pptx\")) return \"application/vnd.openxmlformats-officedocument.presentationml.presentation\";\n  if (lower.endsWith(\".csv\")) return \"text/csv\";\n  if (lower.endsWith(\".txt\")) return \"text/plain\";\n  if (lower.endsWith(\".json\")) return \"application/json\";\n  if (lower.endsWith(\".png\")) return \"image/png\";\n  if (lower.endsWith(\".jpg\") || lower.endsWith(\".jpeg\")) return \"image/jpeg\";\n  return \"application/octet-stream\";\n}\n\nasync function cloudUploadEndpoint(config: ServerConfig, suffix: string, dependencies: CloudUploadDependencies) {\n  const cloud = await (dependencies.readCloudMcp ?? readConnectCloudMcp)(config);","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/apps/server/src/extensions/cloud-uploads.ts#L127-L163","documentation":"If none of the authorized roots resolves to a real file containing the requested path, resolveAuthorizedFile throws a 404 file_not_found ApiError, preventing path-traversal uploads outside the workspace.","triggerScenarios":"Requesting an upload of a path that doesn't exist, or exists but lies outside every authorized root (including symlinked paths whose realpath escapes the roots).","commonSituations":"Typo in the path; file deleted before upload; absolute path outside the workspace; relative path resolving against the wrong cwd; symlink pointing outside the root (realpath check rejects it).","solutions":["Verify the path exists on disk and is spelled correctly, and that it's inside a configured workspace root","Pass an absolute path within an authorized root rather than a relative one","Replace symlinks with the real file inside the root (symlinks escaping the root are rejected by the realpath check)","Recreate the file if it was moved or deleted since selection"],"exampleFix":"// before\nawait upload(\"../secrets/creds.txt\"); // outside workspace\n// after\nawait upload(\"/Users/me/projects/app/notes/notes.pdf\"); // inside root","handlingStrategy":"validation","validationCode":"const real = await realpath(p); const inside = (await Promise.all(roots.map(r => realpath(r)))).some(r => real.startsWith(r + sep)); if (!inside) throw new Error(\"outside workspace\");","typeGuard":null,"tryCatchPattern":"try { await uploadCloud(p); } catch (e) { if (e.code === \"file_not_found\") { promptRepickFile(); } else throw e; }","preventionTips":["Use workspace-scoped file pickers only","Resolve symlinks before upload","Confirm existence immediately before upload"],"tags":["uploads","path-resolution","http-404"],"backgroundTag":"file-not-found","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}