{"record":{"id":"d1411632f0c5aa21","repo":"chatboxai/chatbox","slug":"not-found","errorCode":null,"errorMessage":"Not found","messagePattern":"Not found","errorType":"http","errorClass":"Error","httpStatus":404,"severity":"warning","filePath":"src/main/sandbox/preview-server.ts","lineNumber":108,"sourceCode":"    return null\n  }\n}\n\nasync function resolveRequestPath(\n  req: IncomingMessage,\n  sandboxRoots: string[]\n): Promise<{\n  relativePath: string\n  resolvedPath: string\n}> {\n  const url = new URL(req.url || '/', 'http://127.0.0.1')\n  let relativePath: string\n\n  if (url.pathname.startsWith('/sandbox/')) {\n    relativePath = decodeUrlPath(url.pathname.slice('/sandbox/'.length))\n  } else {\n    const refererDir = getRefererRelativeDir(req)\n    if (!refererDir) throw new Error('Not found')\n    relativePath = path.join(refererDir, decodeUrlPath(url.pathname))\n  }\n\n  // The relative path is resolved against each root; the first match that stays inside\n  // its root and exists wins. Single self-contained artifacts resolve unambiguously.\n  for (const sandboxRoot of sandboxRoots) {\n    const targetPath = path.resolve(sandboxRoot, relativePath)\n    try {\n      const resolvedPath = await realpath(targetPath)\n      if (isInside(sandboxRoot, resolvedPath)) {\n        return { relativePath: path.relative(sandboxRoot, resolvedPath), resolvedPath }\n      }\n    } catch {\n      // Not in this root — try the next.\n    }\n  }\n  throw new Error('Not found')\n}","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/chatboxai/chatbox/blob/81571269addb6bafb589a920b2883f1e1e084fd1/src/main/sandbox/preview-server.ts#L90-L126","documentation":"Thrown by resolveRequestPath in the sandbox preview server when the request URL does not start with '/sandbox/' AND no usable relative directory can be derived from the Referer header. The referer-based fallback exists so relative links inside an already-served HTML artifact can resolve sibling assets; without a Referer there is no anchor to resolve against.","triggerScenarios":"A GET whose pathname is relative (e.g. '/style.css' or '/assets/x.js') and either has no Referer header, or getRefererRelativeDir(req) returned null/empty because the Referer did not map to a known sandbox path.","commonSituations":"Opening an asset URL directly in a browser (no Referer); a browser that strips Referer (strict Referrer-Policy, privacy extension); an <img>/<link> whose referrerpolicy='no-referrer'; serving an entry HTML at the wrong URL so its subsequent relative requests lack a matching Referer.","solutions":["Ensure entry artifacts are served under '/sandbox/<relativePath>' so all assets are requested with '/sandbox/' prefixes and never need the Referer fallback.","If you must use relative URLs, make sure the HTML document itself was loaded through the preview server (so the browser sends a sandbox Referer).","Avoid referrerpolicy='no-referrer' / strict Referrer-Policy on sandboxed preview documents.","Return a 404 response instead of throwing where the caller already wraps in try/catch and maps to 404 (see [85])."],"exampleFix":"// before\nconst refererDir = getRefererRelativeDir(req)\nif (!refererDir) throw new Error('Not found')\n\n// after: also accept an explicit base query param as a fallback\nconst refererDir = getRefererRelativeDir(req) || url.searchParams.get('base')\nif (!refererDir) throw new Error('Not found')","handlingStrategy":"validation","validationCode":"const url = new URL(req.url || '/', 'http://127.0.0.1')\nif (!url.pathname.startsWith('/sandbox/') && !req.headers.referer) { return send404(res) }","typeGuard":"function isPreviewNotFound(e: unknown): e is Error { return e instanceof Error && e.message === 'Not found' }","tryCatchPattern":"// handleRequest already maps thrown 'Not found' to 404; no extra catch needed at resolveRequestPath level.","preventionTips":["Serve entry artifacts under '/sandbox/' so assets inherit that prefix.","Avoid referrerpolicy='no-referrer' on sandboxed documents.","Load the HTML document itself through the preview server to ensure a sandbox Referer."],"tags":["sandbox","preview-server","http","typescript"],"backgroundTag":null,"analyzedSha":"81571269addb6bafb589a920b2883f1e1e084fd1","analyzedAt":"2026-08-12T21:51:44.981Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}