apple/pkl · error · VmException

rethrown PackageLoadError / SecurityManagerException…

Error message

rethrown PackageLoadError / SecurityManagerException (message from cause)

What it means

A `SecurityManagerException` or `PackageLoadError` raised while resolving an import is rethrown as a PklError carrying the original exception as its cause. The visible message comes from the cause (e.g. a security-manager denial of a file path, or a package/dependency resolution failure).

Solutions

  1. Read the cause message to see whether it is a security-manager denial or a package load failure
  2. Widen allowed modules/roots (e.g. --allowed-modules) if the path is legitimately needed
  3. Resolve project dependencies with `pkl project resolve` and verify package coordinates
  4. Fix the import to point inside the permitted area
Defensive patterns

Strategy: try-catch

Validate before calling

// confirm the import target is within allowed roots before eval:
// pkl eval module.pkl --allowed-modules '**' (dev only) to see if the error disappears

Try / catch

// Inspect the cause: if SecurityManagerException -> adjust --allowed-modules; if PackageLoadError -> run `pkl project resolve` and fix package deps

Prevention

When it happens

Trigger: Importing a module located outside the paths allowed by the security manager, or an import resolved through a package that failed to load (missing dependency, bad PackageAsset load).

Common situations: CLI sandboxing/`--allowed-modules` restrictions excluding the import target; cache or dependency problems with `pkl project` packages.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/52b32c724bc8f038. Report an issue: GitHub.

Appendix: source

Thrown at pkl-core/src/main/java/org/pkl/core/ast/builder/AstBuilder.java:3263

      if (path != null && path.contains("\\")) {
        exceptionBuilder.withHint(
            "To resolve modules in nested directories, use `/` as the directory separator.");
      }
      throw exceptionBuilder.build();
    } catch (URISyntaxException e) {
      throw exceptionBuilder()
          .evalError("invalidModuleUri", importUri)
          .withHint(e.getReason())
          .withSourceSection(createSourceSection(ctx))
          .build();
    } catch (IOException e) {
      throw exceptionBuilder()
          .evalError("ioErrorLoadingModule", importUri)
          .withCause(e)
          .withSourceSection(createSourceSection(ctx))
          .build();
    } catch (SecurityManagerException | PackageLoadError e) {
      throw exceptionBuilder().withSourceSection(createSourceSection(ctx)).withCause(e).build();
    } catch (VmException e) {
      throw exceptionBuilder()
          .evalError(e.getMessage(), e.getMessageArguments())
          .withCause(e.getCause())
          .withHintBuilder(e.getHintBuilder())
          .withSourceSection(createSourceSection(ctx))
          .build();
    } catch (ExternalReaderProcessException e) {
      throw exceptionBuilder()
          .evalError("externalReaderFailure")
          .withCause(e.getCause())
          .withSourceSection(createSourceSection(ctx))
          .build();
    }

    if (!resolvedUri.isAbsolute()) {
      throw exceptionBuilder()
          .evalError("cannotHaveRelativeImport", moduleKey.getUri())

View on GitHub (pinned to f3efcbfc9b)