{"record":{"id":"62f0c180523c0729","repo":"n8n-io/n8n","slug":"access-denied-excludedsegment-is-excluded-fr","errorCode":null,"errorMessage":"Access denied: \"${excludedSegment}\" is excluded from filesystem reads","messagePattern":"Access denied: \"(.+?)\" is excluded from filesystem reads","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/@n8n/computer-use/src/tools/filesystem/fs-utils.ts","lineNumber":146,"sourceCode":"\t\t'.prettierrc.json',\n\t\t'.editorconfig',\n\t\t'.gitignore',\n\t\t'.dockerignore',\n\t\t'.nvmrc',\n\t\t'.node-version',\n\t\t'.npmrc',\n\t\t'.babelrc',\n\t\t'.browserslistrc',\n\t]);\n\treturn allowed.has(name);\n}\n\nexport function assertNoExcludedSegments(absolutePath: string, basePath: string): void {\n\tconst relativePath = path.relative(path.resolve(basePath), path.resolve(absolutePath));\n\tconst segments = relativePath.split(path.sep).filter(Boolean);\n\tconst excludedSegment = segments.find(isExcludedDirName);\n\tif (excludedSegment) {\n\t\tthrow new Error(`Access denied: \"${excludedSegment}\" is excluded from filesystem reads`);\n\t}\n}\n\nexport function isExcludedDirName(segment: string): boolean {\n\treturn NORMALIZED_EXCLUDED_DIRS.has(segment.toLowerCase());\n}\n\nexport function isLikelyBinaryContent(buffer: Buffer): boolean {\n\tif (buffer.length === 0) return false;\n\tif (buffer.includes(0)) return true;\n\n\ttry {\n\t\tutf8Decoder.decode(buffer);\n\t} catch {\n\t\treturn true;\n\t}\n\n\tconst checkSlice = buffer.subarray(0, Math.min(BINARY_CHECK_SIZE, buffer.length));","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/computer-use/src/tools/filesystem/fs-utils.ts#L128-L164","documentation":"Thrown by assertNoExcludedSegments() (called from resolveReadablePath) when the resolved path contains a directory segment matching an excluded name: node_modules, .git, dist, build, coverage, __pycache__, .venv, venv, .vscode, .idea, .next, .nuxt, .cache, .turbo, .output, .svelte-kit. The comparison is case-insensitive. resolveReadablePath runs this check on both the logical and real (symlink-resolved) paths, so symlinks into excluded directories are also caught.","triggerScenarios":"A read_file or search_files call targets a path inside node_modules/, .git/, dist/, or any other excluded directory. Also fires if a symlink resolves into an excluded directory.","commonSituations":"Agent tries to read a library source file in node_modules to understand an API, or tries to read .git internals, or accesses a build output in dist/.","solutions":["Use the library's public type definitions or documentation instead of reading source in node_modules","Copy the specific needed file into the base directory if read access is essential","Check the EXCLUDED_DIRS set in fs-utils.ts to see which directory names are blocked","Use search_files with a pattern that excludes the blocked directory"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import { EXCLUDED_DIRS } from './fs-utils';\n\nfunction containsExcludedSegment(relativePath: string): string | null {\n  const excluded = new Set([...EXCLUDED_DIRS].map(d => d.toLowerCase()));\n  const segment = relativePath.split('/').find(s => excluded.has(s.toLowerCase()));\n  return segment ?? null;\n}\n\n// Before calling read_file or search_files:\nconst blocked = containsExcludedSegment(filePath);\nif (blocked) {\n  throw new Error(`Cannot read inside excluded directory: ${blocked}`);\n}","typeGuard":"function isExcludedSegmentError(e: unknown): boolean {\n  return e instanceof Error && e.message.startsWith('Access denied:') && e.message.includes('is excluded from filesystem reads');\n}","tryCatchPattern":null,"preventionTips":["Check the EXCLUDED_DIRS set in fs-utils.ts to know which directories are blocked","Avoid paths through node_modules, .git, dist, build, and other dependency/VCS/build dirs","Use the library's type definitions or documentation instead of reading source in excluded dirs"],"tags":["filesystem","security","validation","computer-use"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}