{"record":{"id":"5129bc68cb3bad8a","repo":"astrid-runtime/astrid","slug":"compiled-wasm-binary-escapes-configured-target","errorCode":null,"errorMessage":"Compiled WASM binary {} escapes configured target directory {}","messagePattern":"Compiled WASM binary (.+?) escapes configured target directory (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-build/src/rust.rs","lineNumber":655,"sourceCode":"\n    // A regular artifact beneath a symlinked parent could still resolve\n    // outside the configured root. Canonicalize only for containment; return\n    // Cargo's path so callers retain the authoritative configured location,\n    // including when the target root itself is a legitimate symlink.\n    let resolved_target_root = fs::canonicalize(target_root).with_context(|| {\n        format!(\n            \"Failed to resolve target directory {}\",\n            target_root.display()\n        )\n    })?;\n    let resolved_candidate = fs::canonicalize(&candidate).with_context(|| {\n        format!(\n            \"Failed to resolve compiled WASM binary {}\",\n            candidate.display()\n        )\n    })?;\n    if !resolved_candidate.starts_with(&resolved_target_root) {\n        bail!(\n            \"Compiled WASM binary {} escapes configured target directory {}\",\n            candidate.display(),\n            target_root.display()\n        );\n    }\n\n    Ok(candidate)\n}\n\n/// Merge the developer's `Capsule.toml` with any extracted description.\nfn build_manifest_content(\n    dir: &Path,\n    wasm_path: &Path,\n    crate_name: &str,\n    package_version: &str,\n    wasm_name: &str,\n) -> Result<String> {\n    let capsule_description = extract_capsule_description(wasm_path);","sourceCodeStart":637,"sourceCodeEnd":673,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-build/src/rust.rs#L637-L673","documentation":"Fired by locate_wasm_binary after canonicalization when the artifact resolves outside the configured target directory root — e.g. a regular file under a symlinked parent redirects elsewhere. Containment is enforced even when the target root itself is a legitimate symlink.","triggerScenarios":"Thrown at crates/astrid-build/src/rust.rs:655 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point the target directory at a real directory without symlinked parents","Rebuild into a target dir fully contained at the configured path","Inspect for environment tampering (CARGO_TARGET_DIR overrides, link farms)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}