HKUDS/Vibe-Trading · error · ValueError

manifest path {manifest_path} is outside the runtime root an

Error message

manifest path {manifest_path} is outside the runtime root and the allowed run roots; place the manifest under one of them (e.g. next to the runs it lists)

What it means

After resolving the manifest path, load_manifest checks it against _manifest_path_allowed(): the resolved path must live under the runtime root or one of the configured allowed run roots. Paths outside these roots are rejected via ValueError. This is a sandbox/path-traversal guard keeping manifest loading inside approved directories.

Source

Thrown at agent/src/tools/strategy_discovery_tool.py:459

    runtime root or an allowed run root (same containment discipline as the
    run_dir entries it names).

    Raises:
        ValueError: With an operator-facing message when the path escapes the
            allowed roots, the file is missing or unreadable, is not valid
            JSON, or has the wrong shape. The agent tool and the CLI share
            this helper so both surfaces report the same failure the same
            way.
    """
    manifest_path = Path(str(path)).expanduser()
    try:
        resolved_manifest = manifest_path.resolve()
    except (OSError, RuntimeError) as exc:
        raise ValueError(
            f"manifest path {manifest_path} could not be resolved: {exc}"
        ) from exc
    if not _manifest_path_allowed(resolved_manifest):
        raise ValueError(
            f"manifest path {manifest_path} is outside the runtime root and "
            "the allowed run roots; place the manifest under one of them "
            "(e.g. next to the runs it lists)"
        )
    try:
        raw = manifest_path.read_text(encoding="utf-8")
    except OSError as exc:
        raise ValueError(
            f"manifest file {manifest_path} is missing or unreadable "
            f"({exc.strerror or 'I/O error'})"
        ) from exc
    try:
        parsed = json.loads(raw)
    except json.JSONDecodeError as exc:
        raise ValueError(
            f"manifest file {manifest_path} is not valid JSON: {exc.msg} "
            f"at line {exc.lineno} column {exc.colno}"
        ) from exc

View on GitHub (pinned to 80ffdda44c)

Solutions

1. Move the manifest under the runtime root or one of the allowed run roots (the error suggests placing it next to the runs it lists)
2. Check _manifest_path_allowed / the tool's configuration to see which roots are allowed, and extend the allowlist if legitimate
3. Use a path relative to the runtime root rather than absolute paths elsewhere on disk

Example fix

# before
core(manifest_path="/home/me/manifest.json", ...)
# after
# copy next to the runs it references, inside an allowed run root
core(manifest_path="runs/2024-06-01/manifest.json", ...)

from pathlib import Path
from agent.src.tools.strategy_discovery_tool import _manifest_path_allowed
if not _manifest_path_allowed(Path(manifest_path).resolve()):
    raise ValueError("manifest must live under the runtime root or an allowed run root")
core(manifest_path=manifest_path, ...)

When it happens

Trigger: Passing an absolute path like "/etc/evil/manifest.json" or a relative one like "../../outside/manifest.json" whose resolved location escapes the runtime root and allowed run roots; using /tmp paths that are not allowlisted.

Common situations: Operators pointing at a manifest stored next to unrelated run outputs outside the sandbox; CI copying manifests to arbitrary temp dirs; relative paths resolved against an unexpected CWD that lands outside allowed roots.

Related errors

• manifest path {manifest_path} could not be resolved: {exc}
• manifest file {manifest_path} is missing or unreadable ({exc
• manifest file {manifest_path} is not valid JSON: {exc.msg} a
• manifest file {manifest_path} must be a JSON object with a '
• run_id must not be empty

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/3fe04ea866ae0b8e. Report an issue: GitHub.