{"record":{"id":"9e66e9ee9c1ca4cf","repo":"garrytan/gstack","slug":"load-html-absolutepath-must-be-under-safe-di","errorCode":null,"errorMessage":"load-html: ${absolutePath} must be under ${SAFE_DIRECTORIES.join(' or ')} (security policy). Copy the file into the project tree or /tmp first.","messagePattern":"load-html: (.+?) must be under (.+?) \\(security policy\\)\\. Copy the file into the project tree or /tmp first\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"browse/src/write-commands.ts","lineNumber":266,"sourceCode":"\n      if (!filePath) throw new Error('Usage: browse load-html <file> [--wait-until load|domcontentloaded|networkidle] [--tab-id <N>]  |  load-html --from-file <payload.json> [--tab-id <N>]');\n\n      // Extension allowlist\n      const ALLOWED_EXT = ['.html', '.htm', '.xhtml', '.svg'];\n      const ext = path.extname(filePath).toLowerCase();\n      if (!ALLOWED_EXT.includes(ext)) {\n        throw new Error(\n          `load-html: file does not appear to be HTML. Expected .html/.htm/.xhtml/.svg, got ${ext || '(no extension)'}. Rename the file if it's really HTML.`\n        );\n      }\n\n      const absolutePath = path.resolve(filePath);\n\n      // Safe-dirs check (reuses canonical read-side policy)\n      try {\n        validateReadPath(absolutePath);\n      } catch (e: any) {\n        throw new Error(\n          `load-html: ${absolutePath} must be under ${SAFE_DIRECTORIES.join(' or ')} (security policy). Copy the file into the project tree or /tmp first.`\n        );\n      }\n\n      // stat check — reject non-file targets with actionable error\n      let stat: fs.Stats;\n      try {\n        stat = await fs.promises.stat(absolutePath);\n      } catch (e: any) {\n        if (e.code === 'ENOENT') {\n          throw new Error(\n            `load-html: file not found at ${absolutePath}. Check spelling or copy the file under ${process.cwd()} or ${TEMP_DIR}.`\n          );\n        }\n        throw e;\n      }\n      if (stat.isDirectory()) {\n        throw new Error(`load-html: ${absolutePath} is a directory, not a file. Pass a .html file.`);","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/garrytan/gstack/blob/94993f74012782fd94416dd44b8314f6363a13a4/browse/src/write-commands.ts#L248-L284","documentation":"Error \"load-html: ${absolutePath} must be under ${SAFE_DIRECTORIES.join(' or ')} (security policy). Copy the file into the project tree or /tmp first.\" thrown in garrytan/gstack.","triggerScenarios":"Thrown at browse/src/write-commands.ts:266 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"94993f74012782fd94416dd44b8314f6363a13a4","analyzedAt":"2026-08-12T04:06:23.140Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}