zeroclaw-labs/zeroclaw · error · anyhow::Error

Screenshot path '{ $path }' is not in the workspace allowlis

Error message

Screenshot path '{ $path }' is not in the workspace allowlist

What it means

Error "Screenshot path '{ $path }' is not in the workspace allowlist" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-tools/src/browser.rs:864

    /// 6. Rejects canonical destinations that are not valid UTF-8.
    ///
    /// Shared by the local backends (`validate_screenshot_path`) and the
    /// ComputerUse flow (`validate_screenshot_path_for_computer_use`) so one
    /// policy cannot drift between them.
    ///
    /// Returns the validated target as a lossless UTF-8 string. Every backend
    /// consumes the destination as a string (command argument, JSON value, or
    /// `tokio::fs::write(&str)`), so a canonical destination that is not valid
    /// UTF-8 is rejected here: a lossy conversion could change the pathname and
    /// name a location that never passed the allowlist.
    async fn validate_screenshot_target(&self, raw_path: &str) -> anyhow::Result<String> {
        // String-level reject (null bytes, .. traversal, URL-encoded traversal)
        if !self.security.is_path_allowed(raw_path) {
            let msg = crate::i18n::get_required_tool_string_with_args(
                "tool-browser-screenshot-error-path-not-allowed",
                &[("path", raw_path)],
            );
            anyhow::bail!("{msg}");
        }

        // Resolve relative / tilde paths against the workspace directory.
        let full = self.security.resolve_tool_path(raw_path);

        // The file does not exist yet, so canonicalize the *parent* directory
        // to verify it is inside the workspace allowlist.
        let parent = full.parent().unwrap_or(&full);
        let canonical = tokio::fs::canonicalize(parent).await.with_context(|| {
            crate::i18n::get_required_tool_string_with_args(
                "tool-browser-screenshot-error-parent-not-exist",
                &[
                    ("path", raw_path),
                    ("parent", &parent.display().to_string()),
                ],
            )
        })?;

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Save the screenshot to a path inside the workspace allowlist.

When it happens

Trigger: Thrown at crates/zeroclaw-tools/src/browser.rs:864 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/b84ab62caa11c89b. Report an issue: GitHub.