heygen-com/hyperframes · critical · Error

Unsafe target "${target}": Windows drive letters are not all

Error message

Unsafe target "${target}": Windows drive letters are not allowed.

What it means

Thrown by assertSafeTarget when a registry file target starts with a Windows drive letter (e.g. 'C:\\' or 'D:/'). Such targets are absolute on Windows and would escape destDir; the guard rejects them even on POSIX hosts so a cross-platform registry can't ship drive-lettered paths.

Source

Thrown at packages/cli/src/registry/installer.ts:102

  if (!installed) return true;
  return installed !== digest(onDisk);
}

/**
 * Reject target paths that would escape `destDir`. Mirrors the pattern check
 * in `packages/core/schemas/registry-item.json#files.items.target`, but runs at
 * install time so a registry that bypasses schema validation still can't write
 * outside the project.
 */
export function assertSafeTarget(destDir: string, target: string): void {
  if (isAbsolute(target)) {
    throw new Error(`Unsafe target "${target}": absolute paths are not allowed.`);
  }
  if (/(^|[/\\])\.\.([/\\]|$)/.test(target)) {
    throw new Error(`Unsafe target "${target}": path segments may not contain "..".`);
  }
  if (/^[A-Za-z]:[/\\]/.test(target)) {
    throw new Error(`Unsafe target "${target}": Windows drive letters are not allowed.`);
  }
  const resolved = resolve(destDir, target);
  const rel = relative(resolve(destDir), resolved);
  if (rel.startsWith("..") || isAbsolute(rel)) {
    throw new Error(`Unsafe target "${target}": resolves outside destDir ${destDir}.`);
  }
}

function isInstalledRegistryBlockComposition(item: RegistryItem, file: FileTarget): boolean {
  return (
    item.type === "hyperframes:block" &&
    file.type === "hyperframes:composition" &&
    file.target.toLowerCase().endsWith(".html")
  );
}

function addRegistryItemMarker(source: string, item: RegistryItem): string {
  if (/^\s*<!--\s*hyperframes-registry-item:[^>]*-->/i.test(source.slice(0, 512))) {

View on GitHub (pinned to c2996c8626)

Solutions

1. Replace the drive-lettered target with a project-relative path
2. Use forward-slash relative paths in registry metadata for cross-platform safety
3. Validate against the registry-item.json schema which enforces the same rule
4. Re-publish the registry item with corrected targets

Example fix

// before
{ "target": "C:\\assets\\x.html" }
// after
{ "target": "assets/x.html" }

function noDriveLetter(target: string): boolean {
  return !/^[A-Za-z]:[/\\]/.test(target);
}

function isPortableTarget(target: string): boolean {
  return !/^[A-Za-z]:[/\\]/.test(target);
}

When it happens

Trigger: assertSafeTarget runs during install; target matches /^[A-Za-z]:[/\\]/ (e.g. 'C:\\Users\\x', 'd:/foo') → throw at installer.ts:102.

Common situations: A registry item authored on Windows with a hardcoded drive path; a copy-pasted Windows file path into target metadata; a malicious registry trying to write to a system drive.

Related errors

• Unsafe target "${target}": absolute paths are not allowed.
• Unsafe target "${target}": path segments may not contain "..
• Unsafe target "${target}": resolves outside destDir ${destDi
• --file must be an HTML file inside the project
• Unknown effect type: ${type}

AI-assisted analysis of heygen-com/hyperframes@c2996c8626 (2026-08-12). Data as JSON: /api/errors/902b62e584c1046e. Report an issue: GitHub.