unslothai/unsloth · warning · HTTPException

System directories are not browseable.

Error message

System directories are not browseable.

What it means

Raised as a 403 by _resolve_browse_target when is_denied_system_path() rejects a resolved intermediate component during the walk. It prevents browsing into system directories (e.g. /usr, /bin, /Windows, /Program Files) even if the textual path started under an allowed root — the check runs on the resolved child, so symlinks into system trees are also caught.

Source

Thrown at studio/backend/routes/models.py:1714

                    status_code = 400,
                    detail = "Invalid path",
                ) from exc
            if not _is_path_inside_allowlist(resolved_child, resolved_roots):
                raise HTTPException(
                    status_code = 403,
                    detail = (
                        "Path is not in the browseable allowlist. Register it via "
                        "POST /api/models/scan-folders first, or pick a directory "
                        "under your home folder."
                    ),
                )
            if contains_sensitive_path_component(str(resolved_child)):
                raise HTTPException(
                    status_code = 403,
                    detail = "Credential or configuration directories are not browseable.",
                )
            if is_denied_system_path(str(resolved_child)):
                raise HTTPException(
                    status_code = 403,
                    detail = "System directories are not browseable.",
                )
            current = resolved_child

        if contains_sensitive_path_component(str(current)):
            raise HTTPException(
                status_code = 403,
                detail = "Credential or configuration directories are not browseable.",
            )
        # Zero-component case: the requested path IS an allowlist root (legacy "/" or a drive root).
        if is_denied_system_path(str(current)):
            raise HTTPException(
                status_code = 403,
                detail = "System directories are not browseable.",
            )
        if not current.is_dir():
            raise HTTPException(

View on GitHub (pinned to 203007d190)

Solutions

1. Browse a user-data directory instead; system paths are intentionally excluded from the model browser.
2. If the data genuinely lives under a system path, copy or move it under home or a registered scan folder.
3. Remove symlinks that route the walk through denied system directories.

import os

DENIED_PREFIXES = ('/usr', '/bin', '/sbin', '/etc', '/var', '/lib', 'C:\\Windows', 'C:\\Program Files')

def is_system_path(p: str) -> bool:
    rp = os.path.realpath(p)
    return any(rp == d or rp.startswith(d + os.sep) for d in DENIED_PREFIXES)

if is_system_path(browse_path):
    raise ValueError('system directories are not browseable')

try:
    entries = browse(path)
except HTTPError as e:
    if e.response.status_code == 403 and 'System directories' in e.response.json()['detail']:
        show_user('System folders cannot be browsed. Pick a folder under your home directory.')
    else: raise

When it happens

Trigger: GET browse-folders whose path resolves through or into a denied system directory; a symlink under home pointing into /usr or C:\Windows.

Common situations: Symlinked SDKs/toolchains installed under system paths; users trying to browse Program Files for model binaries; legacy layouts where home contains links into /opt.

Related errors

• Credential or configuration directories are not browseable.
• Directory not allowed
• Path is not in the browseable allowlist. Register it via POS
• Linked folder is no longer a regular directory
• Linked source is not a regular file

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/8ee48fe4bb9afb48. Report an issue: GitHub.