{"record":{"id":"ded8ff83aeefdb31","repo":"Yeachan-Heo/oh-my-codex","slug":"agents-init-target-must-stay-inside-the-current-wo","errorCode":null,"errorMessage":"agents-init target must stay inside the current working directory: ${requestedTarget}","messagePattern":"agents-init target must stay inside the current working directory: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/cli/agents-init.ts","lineNumber":291,"sourceCode":"    await writeFile(destinationPath, content);\n  }\n  summary.updated += 1;\n  return { action: \"updated\", backedUp };\n}\n\nexport async function agentsInit(\n  options: AgentsInitOptions = {},\n): Promise<void> {\n  const dryRun = options.dryRun === true;\n  const force = options.force === true;\n  const verbose = options.verbose === true;\n  const cwd = process.cwd();\n  const requestedTarget = options.targetPath ?? \".\";\n  const targetDir = resolve(cwd, requestedTarget);\n  const relativeTarget = relative(cwd, targetDir);\n\n  if (relativeTarget.startsWith(\"..\")) {\n    throw new Error(\n      `agents-init target must stay inside the current working directory: ${requestedTarget}`,\n    );\n  }\n\n  const targetStat = await stat(targetDir).catch(() => null);\n  if (!targetStat)\n    throw new Error(`agents-init target not found: ${requestedTarget}`);\n  if (!targetStat.isDirectory())\n    throw new Error(\n      `agents-init target must be a directory: ${requestedTarget}`,\n    );\n\n  const summary = createEmptySummary();\n  const plannedDirs = await resolveTargetDirectories(targetDir);\n  const backupRoot = join(\n    cwd,\n    \".omx\",\n    \"backups\",","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/Yeachan-Heo/oh-my-codex/blob/3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2/src/cli/agents-init.ts#L273-L309","documentation":"agents-init resolves --target/<path> against the current working directory and refuses any path that escapes it (relative path starting with '..'). This is a safety boundary so the scaffolder cannot create/modify files outside the project tree. Absolute paths elsewhere on disk are also rejected via the same relative() check.","triggerScenarios":"Passing `--target ../other-project`, `--target /tmp`, or an absolute path outside cwd; symlinks that resolve outside cwd are not caught here but absolute paths are.","commonSituations":"Running agents-init from a subdirectory while pointing at a sibling directory, or scripting against absolute paths in CI where cwd differs from expectations.","solutions":["Run the command from the directory you want to scaffold into and pass `.` or a path inside it","cd to the intended project root first","Use a subdirectory of cwd as the target"],"exampleFix":"# before (cwd=/repo)\nomx agents-init ../other-repo\n\n# after\ncd ../other-repo && omx agents-init .","handlingStrategy":"validation","validationCode":"import { resolve, relative } from 'node:path';\nconst targetDir = resolve(process.cwd(), requestedTarget);\nif (relative(process.cwd(), targetDir).startsWith('..')) {\n  console.error('target must be inside the current working directory');\n  process.exit(2);\n}","typeGuard":"const isInsideCwd = (p: string): boolean => !relative(process.cwd(), resolve(process.cwd(), p)).startsWith('..');","tryCatchPattern":null,"preventionTips":["Always run agents-init from the project root","Pass '.' or relative subdirectory paths","Never feed absolute paths from other locations into --target"],"tags":["cli","path-validation","security","agents-init"],"backgroundTag":"path-traversal-rejected","analyzedSha":"3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2","analyzedAt":"2026-08-27T22:18:39.783Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}