apple/pkl · error · VmException

SecurityManagerException/PackageLoadError (message from…

Error message

SecurityManagerException/PackageLoadError (message from wrapped cause)

What it means

An import failed due to a security or package problem: SecurityManagerException (e.g. module URI not trusted by the security manager) or PackageLoadError (dependency package could not be loaded). The original cause is attached; there is no separate message code — the cause's message is shown.

Solutions

Read the wrapped cause message for the precise denial or package error
Allow the module's URI scheme/path in the security manager (module path / trusted roots) when intentional
Fix the project dependencies: declare the required package in PklProject and run pkl project resolve
Verify network access and package cache integrity

Example fix

// before (CLI)
pkl script.pkl
// after (allow the path or resolve deps)
pkl --allowed-modules file,https script.pkl
# and: pkl project resolve

Defensive patterns

Strategy: try-catch

Validate before calling

if (!allowedSchemes.includes(new URL(uri).protocol)) throw new Error('module URI not trusted: ' + uri)

Try / catch

try { evaluate(module) } catch (e) { const cause = e.cause; if (cause && (cause.name === 'SecurityManagerException' || cause.name === 'PackageLoadError')) { console.error('import blocked/package error:', cause.message) } throw e }

Prevention

Declare all package dependencies in PklProject and run pkl project resolve
Allow required URI schemes/paths via --allowed-modules or the security manager config
Keep the package cache healthy and verify network access to repositories

When it happens

Trigger: Importing modules from URIs the SecurityManager does not allow (not in trusted paths / no module path declared), or importing from a package that fails to load (unresolvable dependency, bad checksum, missing package) during collectImports.

Common situations: Running pkl in restricted mode without whitelisting file/http paths; a project dependency not listed in PklProject dependencies; corrupted or unreachable package cache.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/3df23c2563d78910. Report an issue: GitHub.

Appendix: source

Thrown at pkl-core/src/main/java/org/pkl/core/runtime/VmImportAnalyzer.java:149

      } catch (FileNotFoundException | NoSuchFileException e) {
        throw new VmExceptionBuilder()
            .evalError("cannotFindModule", entry.stringValue())
            .withSourceSection(entry.sourceSection())
            .build();
      } catch (URISyntaxException e) {
        throw new VmExceptionBuilder()
            .evalError("invalidModuleUri", entry.stringValue())
            .withHint(e.getReason())
            .withSourceSection(entry.sourceSection())
            .build();
      } catch (IOException e) {
        throw new VmExceptionBuilder()
            .evalError("ioErrorLoadingModule", entry.stringValue())
            .withCause(e)
            .withSourceSection(entry.sourceSection())
            .build();
      } catch (SecurityManagerException | PackageLoadError e) {
        throw new VmExceptionBuilder()
            .withSourceSection(entry.sourceSection())
            .withCause(e)
            .build();
      } catch (ExternalReaderProcessException e) {
        throw new VmExceptionBuilder()
            .withSourceSection(entry.sourceSection())
            .evalError("externalReaderFailure")
            .withCause(e)
            .build();
      }
    }
    return result;
  }

  private record ImportEntry(URI moduleUri, ResolvedModuleKey resolvedModuleKey) {
    private Import toImport() {
      return new Import(resolvedModuleKey.getOriginal().getUri());
    }

View on GitHub (pinned to f3efcbfc9b)