stablyai/orca · error · Error

Invalid renderer output path: ${String(outputPath)}

Error message

Invalid renderer output path: ${String(outputPath)}

What it means

addOutputPath validates every file path the script stages into the web-client projection. It rejects: non-strings, empty strings, absolute paths (leading '/'), Windows drive letters, backslashes, and any '..' path segment. This is a path-traversal guard — manifest paths must be relative, forward-slashed, and stay under the renderer output root.

Source

Thrown at config/scripts/project-renderer-web-client.mjs:61

        if (entryKeys.has(dependency) && dependency !== sourceEntry) {
          throw new Error(`Renderer entry ${sourceEntry} executes entry ${dependency}`)
        }
        pending.push(dependency)
      }
    }
  }
}

function addOutputPath(outputPath) {
  if (
    typeof outputPath !== 'string' ||
    outputPath.length === 0 ||
    outputPath.startsWith('/') ||
    /^[A-Za-z]:/.test(outputPath) ||
    outputPath.includes('\\') ||
    outputPath.split('/').includes('..')
  ) {
    throw new Error(`Invalid renderer output path: ${String(outputPath)}`)
  }
  selectedFiles.add(outputPath)
}

function visitManifestEntry(key) {
  if (visitedEntries.has(key)) {
    return
  }
  visitedEntries.add(key)

  const entry = manifest[key]
  if (!entry || typeof entry !== 'object') {
    throw new Error(`Renderer manifest is missing entry: ${key}`)
  }

  addOutputPath(entry.file)
  for (const outputPath of [...(entry.css ?? []), ...(entry.assets ?? [])]) {
    addOutputPath(outputPath)

View on GitHub (pinned to 1136503c6a)

Solutions

1. Rebuild the renderer on the same OS that runs the projection, or normalize paths in the build
2. Check Vite config for base/publicDir/assetFileNames that could yield absolute or backslash paths
3. If a legitimate asset legitimately lives outside the renderer root, copy it in first rather than referencing an absolute path
4. Grep the manifest for the offending path shape: paths starting with '/' or containing '\'

function isSafeOutputPath(p) {
  return typeof p === 'string' && p.length > 0 && !p.startsWith('/') && !/^[A-Za-z]:/.test(p) && !p.includes('\\') && !p.split('/').includes('..')
}

function isSafeOutputPath(p) {
  return typeof p === 'string' && p.length > 0 && !p.startsWith('/') && !/^[A-Za-z]:/.test(p) && !p.includes('\\') && !p.split('/').includes('..')
}

When it happens

Trigger: A manifest entry's file, css, or assets field is absolute, contains '\', matches /^[A-Za-z]:/, or contains a '..' segment. Typical with a manifest produced on Windows and consumed on Linux, or a Vite misconfiguration emitting absolute publicDir paths.

Common situations: Cross-OS build/projection (build on Windows, project on Linux); a rollup asset plugin emitting absolute paths; a publicDir set to an absolute external path; manual manifest tampering.

Related errors

• Access denied: invalid submodule path
• spritesheetPath must be relative to the bundle.
• spritesheetPath escapes the bundle.
• Invalid worktree path
• Unsupported macOS build architecture: ${architecture}

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/735da3cdaa904012. Report an issue: GitHub.