Refusing to delete a path outside the plugin directory: "${t

Error message

Refusing to delete a path outside the plugin directory: "${t}" is not under "${root}"

What it means

Error "Refusing to delete a path outside the plugin directory: "${t}" is not under "${root}"" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/plugins/manager.ts:81

  const [bMaj, bMin, bPat] = parse(b);
  if (aMaj !== bMaj) return aMaj - bMaj;
  if (aMin !== bMin) return aMin - bMin;
  return aPat - bPat;
}

// ── SECURITY: CRITICAL-2 ────────────────────────────────────────────────────
/**
 * Assert that `target` is strictly contained within `pluginRoot`.
 * Prevents a tampered/legacy DB `pluginDir` from causing deletion of an
 * arbitrary filesystem path when passed to `rm({ recursive: true })`.
 *
 * Throws immediately if `target` resolves outside `pluginRoot`.
 */
function assertWithinPluginDir(pluginRoot: string, target: string): void {
  const root = resolve(pluginRoot);
  const t = resolve(target);
  if (t !== root && !t.startsWith(root + sep)) {
    throw new Error(
      `Refusing to delete a path outside the plugin directory: "${t}" is not under "${root}"`
    );
  }
}

// ── SECURITY: CRITICAL-3 (shared) ──────────────────────────────────────────
/**
 * Assert that `entryPoint` is strictly within `destDir`.
 * Called at install/upgrade time to reject `manifest.main` values like
 * `"../../evil.js"` before the plugin is ever persisted to DB.
 *
 * Throws if the resolved entryPoint escapes `destDir`.
 */
function assertEntryPointWithinDest(destDir: string, entryPoint: string): void {
  const root = resolve(destDir);
  const ep = resolve(entryPoint);
  if (!ep.startsWith(root + sep)) {
    throw new Error(

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/plugins/manager.ts:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/ae073a9e93c76722. Report an issue: GitHub.