diegosouzapw/OmniRoute · error

Plugin '${name}' entry point escapes plugin directory

Error message

Plugin '${name}' entry point escapes plugin directory

What it means

Error "Plugin '${name}' entry point escapes plugin directory" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/plugins/manager.ts:398

    // silently enforces nothing while the UI still reports it as active.
    if (row.status === "active" && this.loadedPlugins.has(name)) return;

    const manifest = JSON.parse(row.manifest) as PluginManifestWithDefaults;

    // Path traversal guard: use realpath to resolve symlinks
    const entryPoint = join(row.pluginDir, manifest.main);
    let resolvedPluginDir: string;
    try {
      resolvedPluginDir = await realpath(row.pluginDir);
    } catch {
      throw new Error(`Plugin directory '${row.pluginDir}' does not exist`);
    }
    const resolvedEntry = await realpath(entryPoint).catch(() => null);
    if (
      !resolvedEntry ||
      (!resolvedEntry.startsWith(resolvedPluginDir + sep) && resolvedEntry !== resolvedPluginDir)
    ) {
      throw new Error(`Plugin '${name}' entry point escapes plugin directory`);
    }

    try {
      const loaded = await loadPlugin(entryPoint, manifest);

      const hookNames: LifecycleHookName[] = [
        "onRequest",
        "onResponse",
        "onError",
        "onInstall",
        "onActivate",
        "onDeactivate",
        "onUninstall",
      ];
      for (const hookName of hookNames) {
        const handler = loaded.plugin[hookName];
        if (typeof handler === "function") {
          registerHook(hookName, name, handler as HookHandler);

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/plugins/manager.ts:398 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/71c924ddb3886031. Report an issue: GitHub.