quasarframework/quasar · critical · Error

Refusing to remove the user home directory as build output

Error message

Refusing to remove the user home directory as build output

What it means

A safety guard in getBuildArtifactsCleanTarget that refuses to delete the user's home directory as build output. Both the resolved target and its symlink-resolved effective target are compared against the realpath of os.homedir(), so even a symlink or alias pointing home is caught.

Source

Thrown at app-vite/lib/utils/remove-build-artifacts.js:76

    throw new Error('Build output directory must be a non-empty path')
  }

  if (typeof projectDir !== 'string' || projectDir.trim() === '') {
    throw new Error('Project directory must be a non-empty path')
  }

  const project = resolve(projectDir)
  const effectiveProject = fse.realpathSync(project)
  const home = fse.realpathSync(resolve(homedir()))
  const target = resolve(projectDir, targetDir)
  const effectiveTarget = getEffectivePath(target)

  if (isFilesystemRoot(target) || isFilesystemRoot(effectiveTarget)) {
    throw new Error('Refusing to remove a filesystem root as build output')
  }

  if (target === home || effectiveTarget === home) {
    throw new Error(
      'Refusing to remove the user home directory as build output'
    )
  }

  if (target === project || effectiveTarget === effectiveProject) {
    throw new Error('Refusing to remove the project root as build output')
  }

  if (
    allowOutsideProject !== true &&
    isContainedPath(effectiveProject, effectiveTarget) === false
  ) {
    throw new Error(
      'Build output directory must remain inside the project. Set build.allowOutsideProjectDistDir to true to explicitly allow an external directory.'
    )
  }

  return { target, effectiveTarget }

View on GitHub (pinned to 4841521b5f)

Solutions

1. Set distDir to a project-relative subdirectory such as 'dist'
2. Inspect the configured path and any symlinks with 'readlink -f' to confirm it does not resolve to $HOME
3. Avoid passing raw HOME-based env vars as the output directory; validate against path.resolve(os.homedir()) first

Example fix

// before
distDir: process.env.HOME
// after
distDir: 'dist'

const os = require('node:os')
const path = require('node:path')
const fs = require('node:fs')
const home = fs.realpathSync(os.homedir())
const target = path.resolve(projectDir, distDir)
if (target === home || (fs.existsSync(target) && fs.realpathSync(target) === home)) {
  throw new Error('dist dir resolves to the home directory')
}

try {
  await removeBuildArtifacts(opts)
} catch (err) {
  if (err.message === 'Refusing to remove the user home directory as build output') {
    // correct the distDir config before any deletion
  } else throw err
}

When it happens

Trigger: Configuring the build output directory as '~', $HOME, /home/user, or any path whose realpath equals the home directory (including a symlink inside the project that points home).

Common situations: distDir: '~' without expansion semantics resolving unexpectedly; DIST_DIR=/ home env leakage; a symlink named dist -> ~ created by tooling; running with HOME=/ in containers making a relative-ish path resolve to home.

Related errors

• Refusing to remove a filesystem root as build output
• Refusing to remove the project root as build output
• Could not resolve an existing ancestor for "${target}"
• Build output directory must remain inside the project. Set b
• Could not generate ${assetRelativePath}.

AI-assisted analysis of quasarframework/quasar@4841521b5f (2026-08-30). Data as JSON: /api/errors/5dc8adc1f6b8016a. Report an issue: GitHub.