Tencent/WeKnora · error

remote sandbox: read script: %w

Error message

remote sandbox: read script: %w

What it means

readScriptContent loads the local script file from cfg.Script with os.ReadFile. Missing files map to ErrScriptNotFound, but any other read failure (permissions, I/O error, path is a directory) is wrapped with this message. It happens before anything is uploaded to the remote sandbox.

Source

Thrown at internal/sandbox/remote_sandbox.go:268

	}
}

// readScriptContent resolves the script bytes to upload into the sandbox.
// It prefers cfg.ScriptContent (populated by the security validator) and
// falls back to reading cfg.Script from local disk.
func readScriptContent(cfg *ExecuteConfig) ([]byte, error) {
	if cfg.ScriptContent != "" {
		return []byte(cfg.ScriptContent), nil
	}
	if cfg.Script == "" {
		return nil, ErrInvalidScript
	}
	content, err := os.ReadFile(cfg.Script)
	if err != nil {
		if os.IsNotExist(err) {
			return nil, ErrScriptNotFound
		}
		return nil, fmt.Errorf("remote sandbox: read script: %w", err)
	}
	return content, nil
}

// boundedExecuteContext returns a derived context with the effective timeout
// applied. It is only used on the ephemeral path; persistent execution runs
// under SessionBoundManager's context (which the lifecycle lock already
// bounds).
func boundedExecuteContext(parent context.Context, cfg *ExecuteConfig) (context.Context, context.CancelFunc) {
	timeout := effectiveTimeout(cfg, 0)
	if timeout <= 0 {
		return parent, func() {}
	}
	return context.WithTimeout(parent, timeout)
}

func effectiveTimeout(cfg *ExecuteConfig, fallback time.Duration) time.Duration {
	if cfg != nil && cfg.Timeout > 0 {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Check the wrapped cause: if permission denied, chmod/chown the script to be readable
2. Verify cfg.Script points to a regular file, not a directory, and exists on the local filesystem
3. Handle ErrScriptNotFound separately — the library already distinguishes it
4. In containers, ensure the script is copied into the image or the volume is mounted

Example fix

// before
// script baked into a read-only 0600 root-owned file
// after
if err := os.Chmod(scriptPath, 0o755); err != nil {
    return fmt.Errorf("make script readable: %w", err)
}
res, err := sbx.ExecuteOnHandle(ctx, handle, cfg)

info, err := os.Stat(cfg.Script)
if err != nil { return err }
if !info.Mode().IsRegular() || info.Mode().Perm()&0o400 == 0 {
    return fmt.Errorf("script %s not a readable regular file", cfg.Script)
}

func readableScript(p string) bool {
    i, err := os.Stat(p)
    return err == nil && i.Mode().IsRegular()
}

res, err := sbx.ExecuteOnHandle(ctx, handle, cfg)
if err != nil {
    if errors.Is(err, sandbox.ErrScriptNotFound) { return errScriptMissing }
    if strings.Contains(err.Error(), "read script") { return errScriptUnreadable }
    return err
}

When it happens

Trigger: ExecuteOnHandle path where cfg.Script exists in name but cannot be read: permission denied, file deleted between check and read, path is a directory, or disk I/O error.

Common situations: Scripts referenced from a mounted volume that unmounted; wrong file mode in a container; script path pointing at a directory after a refactor; filesystem full.

Related errors

• failed to load script: %w
• storage directory not accessible: %w
• storage path is not a directory: %s
• failed to create directory: %w
• failed to open file: %w

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/c8726d9bc0888552. Report an issue: GitHub.