{"record":{"id":"b84ab62caa11c89b","repo":"zeroclaw-labs/zeroclaw","slug":"screenshot-path-path-is-not-in-the-workspac","errorCode":null,"errorMessage":"Screenshot path '{ $path }' is not in the workspace allowlist","messagePattern":"Screenshot path '(.+?)' is not in the workspace allowlist","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/browser.rs","lineNumber":864,"sourceCode":"    /// 6. Rejects canonical destinations that are not valid UTF-8.\n    ///\n    /// Shared by the local backends (`validate_screenshot_path`) and the\n    /// ComputerUse flow (`validate_screenshot_path_for_computer_use`) so one\n    /// policy cannot drift between them.\n    ///\n    /// Returns the validated target as a lossless UTF-8 string. Every backend\n    /// consumes the destination as a string (command argument, JSON value, or\n    /// `tokio::fs::write(&str)`), so a canonical destination that is not valid\n    /// UTF-8 is rejected here: a lossy conversion could change the pathname and\n    /// name a location that never passed the allowlist.\n    async fn validate_screenshot_target(&self, raw_path: &str) -> anyhow::Result<String> {\n        // String-level reject (null bytes, .. traversal, URL-encoded traversal)\n        if !self.security.is_path_allowed(raw_path) {\n            let msg = crate::i18n::get_required_tool_string_with_args(\n                \"tool-browser-screenshot-error-path-not-allowed\",\n                &[(\"path\", raw_path)],\n            );\n            anyhow::bail!(\"{msg}\");\n        }\n\n        // Resolve relative / tilde paths against the workspace directory.\n        let full = self.security.resolve_tool_path(raw_path);\n\n        // The file does not exist yet, so canonicalize the *parent* directory\n        // to verify it is inside the workspace allowlist.\n        let parent = full.parent().unwrap_or(&full);\n        let canonical = tokio::fs::canonicalize(parent).await.with_context(|| {\n            crate::i18n::get_required_tool_string_with_args(\n                \"tool-browser-screenshot-error-parent-not-exist\",\n                &[\n                    (\"path\", raw_path),\n                    (\"parent\", &parent.display().to_string()),\n                ],\n            )\n        })?;\n","sourceCodeStart":846,"sourceCodeEnd":882,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/browser.rs#L846-L882","documentation":"Error \"Screenshot path '{ $path }' is not in the workspace allowlist\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-tools/src/browser.rs:864 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Save the screenshot to a path inside the workspace allowlist."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}