pbakaus/impeccable · error

Invalid svelte-component source file

Error message

Invalid svelte-component source file

What it means

Thrown by resolveSourceFile() in live/svelte-component.mjs when the supplied sourceFile is falsy (empty/null/undefined) OR is an absolute path. The function only resolves project-relative paths so it can sandbox the resolved file under the project root; an absolute path would bypass that sandbox. This is the first guard before the escape and existence checks.

Source

Thrown at skill/scripts/live/svelte-component.mjs:444

        const manifest = readManifest(candidate);
        if (manifest?.id === id) return { ...manifest, manifestPath: candidate };
      } catch { /* skip */ }
    }
  }
  return null;
}

export function readManifest(manifestPath) {
  const data = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
  return {
    ...data,
    manifestPath,
  };
}

export function resolveSourceFile(sourceFile, cwd = process.cwd()) {
  if (!sourceFile || path.isAbsolute(sourceFile)) {
    throw new Error('Invalid svelte-component source file');
  }
  const full = path.resolve(cwd, sourceFile);
  const rel = path.relative(cwd, full);
  if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) {
    throw new Error('Svelte-component source file escapes project root');
  }
  if (!fs.existsSync(full)) {
    throw new Error('Svelte-component source file not found: ' + sourceFile);
  }
  return full;
}

function appendCssToSvelteStyle(lines, cssLines) {
  const closeIdx = findLastStyleCloseLine(lines);
  const prepared = ['', ...cssLines.map((line) => (line.trim() === '' ? '' : '  ' + line.trimStart()))];
  if (closeIdx === -1) {
    return [...lines, '', '<style>', ...prepared.slice(1), '</style>'];
  }

View on GitHub (pinned to d14711ae3d)

Solutions

  1. Pass a project-relative path, e.g. 'src/lib/Foo.svelte', not an absolute one.
  2. If you computed an absolute path, convert it: path.relative(cwd, absPath) before calling.
  3. Ensure the sourceFile argument is a non-empty string at the call site.

Example fix

// before
resolveSourceFile(path.resolve(cwd, 'src/Foo.svelte'), cwd)
// after
resolveSourceFile('src/Foo.svelte', cwd)
Defensive patterns

Strategy: validation

Validate before calling

if (!sourceFile || (typeof sourceFile === 'string' && path.isAbsolute(sourceFile))) {
  throw new Error('sourceFile must be a project-relative path');
}

Type guard

function isRelativeSpecifier(v: unknown): v is string {
  return typeof v === 'string' && v.length > 0 && !path.isAbsolute(v);
}

Prevention

When it happens

Trigger: resolveSourceFile(sourceFile, cwd) is called with sourceFile = '', null, undefined, or an absolute path like '/home/user/proj/src/Foo.svelte' or 'C:\\proj\\src\\Foo.svelte'. path.isAbsolute() returns true for leading '/' or a drive letter.

Common situations: Caller passes path.resolve() output (already absolute) instead of the relative specifier; a config field for the component path is empty; a default value of '' leaked through; Windows drive-letter paths; the value was taken from __dirname/import.meta.url resolution.

Related errors


AI-assisted analysis of pbakaus/impeccable@d14711ae3d (2026-08-13). Data as JSON: /api/errors/acd8b86167cd4aeb. Report an issue: GitHub.