{"record":{"id":"ef33ed759d2275a6","repo":"Yeachan-Heo/oh-my-codex","slug":"refusing-cancellation-outside-authorized-state-roo","errorCode":null,"errorMessage":"Refusing cancellation outside authorized state root: ${ref.path}.","messagePattern":"Refusing cancellation outside authorized state root: (.+?)\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/cli/index.ts","lineNumber":8413,"sourceCode":"          dev: number;\n          ino: number;\n        }\n      >();\n      if (refs.length === 0) return loaded;\n      const canonicalAuthorityRoot = assertCancellationAuthorityPath(\n        authorityRoot === writableScope.stateDir ? baseStateDir : authorityRoot,\n        authorityRoot,\n      );\n      for (const ref of refs) {\n        const fileStat = lstatSync(ref.path);\n        if (!fileStat.isFile() || fileStat.isSymbolicLink()) {\n          throw new Error(`Refusing cancellation through non-regular state target ${ref.path}.`);\n        }\n        const canonicalPath = realpathSync(ref.path);\n        const canonicalParent = realpathSync(dirname(ref.path));\n        if (!isCanonicalPathWithin(canonicalAuthorityRoot, canonicalParent, true)\n          || !isCanonicalPathWithin(canonicalAuthorityRoot, canonicalPath)) {\n          throw new Error(`Refusing cancellation outside authorized state root: ${ref.path}.`);\n        }\n        const content = await readFile(canonicalPath, \"utf-8\");\n        let parsedState: Record<string, unknown>;\n        try {\n          const parsed = JSON.parse(content) as unknown;\n          if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n            throw new Error(\"state must be a JSON object\");\n          }\n          parsedState = parsed as Record<string, unknown>;\n        } catch (err) {\n          logCliOperationFailure(err);\n          throw new Error(`Refusing partial cancellation because ${ref.path} is malformed.`, { cause: err });\n        }\n        if (typeof parsedState.mode === \"string\" && parsedState.mode !== ref.mode) {\n          throw new Error(`Refusing contradictory mode state in ${ref.path}.`);\n        }\n        if (ref.mode === SKILL_ACTIVE_STATE_MODE && exactAuthority) {\n          const hasTopCodexOwner = Object.prototype.hasOwnProperty.call(parsedState, \"owner_codex_session_id\");","sourceCodeStart":8395,"sourceCodeEnd":8431,"githubUrl":"https://github.com/Yeachan-Heo/oh-my-codex/blob/3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2/src/cli/index.ts#L8395-L8431","documentation":"After canonicalizing each state target with realpath, the cancel command verifies both the file and its parent directory resolve inside the authorized state root. If either escapes that root (via symlinked parents, ../ segments, or bind mounts), cancellation refuses with this error. This is a path-containment security check preventing writes outside authorized state boundaries.","triggerScenarios":"A state path whose canonical resolution lands outside the authority root: a parent directory that is a symlink to elsewhere, a path containing .. that escapes, or the file itself being a link to a file in another tree.","commonSituations":"State directory or its parents symlinked (common in dotfiles or multi-project setups); misconfigured stateDir pointing at a path whose realpath differs; running inside containers with overlapping mounts; moved project directories where realpath differs from the configured path.","solutions":["Check whether any component of the referenced state path is a symlink and replace it with its real location","Ensure the configured state directory's realpath matches what the authority root expects","Re-run cancel from the workspace root so the state scope resolves canonically","Remove stale symlinked parents and use direct paths"],"exampleFix":"# before\n~/.omx -> /mnt/shared/omx   (parent symlink escapes root)\n# after\nmv /mnt/shared/omx ~/.omx  (real directory inside expected root)","handlingStrategy":"validation","validationCode":"import { realpathSync, dirname } from \"node:fs\";\nimport { isAbsolute, relative } from \"node:path\";\nfunction pathWithinRoot(path: string, root: string): boolean {\n  const rel = relative(realpathSync(root), realpathSync(path));\n  return rel !== \"\" && !rel.startsWith(\"..\") && !isAbsolute(rel);\n}","typeGuard":"function isCanonicalPathWithin(root: string, target: string): boolean {\n  const rel = relative(realpathSync(root), realpathSync(target));\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n}","tryCatchPattern":null,"preventionTips":["Keep the entire state path free of symlinks","Run cancel from the workspace root so scope resolution is canonical","Verify realpath(configuredStateDir) matches expectations in containerized setups"],"tags":["security","path-traversal","filesystem","cancel","state"],"backgroundTag":"symlink-traversal-refused","analyzedSha":"3ad79a8a6fe6e95fdbb8c00e40716fffe4011ce2","analyzedAt":"2026-08-27T22:18:39.783Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}