Plugin manifest.main resolves outside plugin directory: "${e

Error message

Plugin manifest.main resolves outside plugin directory: "${ep}" escapes "${root}"

What it means

Error "Plugin manifest.main resolves outside plugin directory: "${ep}" escapes "${root}"" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/plugins/manager.ts:99

    throw new Error(
      `Refusing to delete a path outside the plugin directory: "${t}" is not under "${root}"`
    );
  }
}

// ── SECURITY: CRITICAL-3 (shared) ──────────────────────────────────────────
/**
 * Assert that `entryPoint` is strictly within `destDir`.
 * Called at install/upgrade time to reject `manifest.main` values like
 * `"../../evil.js"` before the plugin is ever persisted to DB.
 *
 * Throws if the resolved entryPoint escapes `destDir`.
 */
function assertEntryPointWithinDest(destDir: string, entryPoint: string): void {
  const root = resolve(destDir);
  const ep = resolve(entryPoint);
  if (!ep.startsWith(root + sep)) {
    throw new Error(
      `Plugin manifest.main resolves outside plugin directory: "${ep}" escapes "${root}"`
    );
  }
}

class PluginManager {
  private static instance: PluginManager;
  private loadedPlugins: Map<string, LoadedPlugin> = new Map();
  private pluginDir: string;

  private constructor() {
    this.pluginDir = getDefaultPluginDir();
  }

  static getInstance(): PluginManager {
    if (!PluginManager.instance) {
      PluginManager.instance = new PluginManager();
    }

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/plugins/manager.ts:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/6a27098db682c7ac. Report an issue: GitHub.