Tencent/WeKnora · error

sandbox binding session must not contain braces

Error message

sandbox binding session must not contain braces

What it means

SessionSandboxKey.Validate rejects session IDs containing '{' or '}'. Braces in the session ID would corrupt the Redis key/namespace templating used for sandbox bindings, so such keys are rejected outright.

Source

Thrown at internal/sandbox/session_binding.go:28

	"unicode"
)

// SessionSandboxBindingVersion is the current persisted binding schema.
const SessionSandboxBindingVersion = 1

// SessionSandboxKey identifies one tenant-scoped persistent sandbox.
type SessionSandboxKey struct {
	TenantID  uint64
	SessionID string
}

// Validate rejects keys that cannot identify a tenant session.
func (k SessionSandboxKey) Validate() error {
	if k.TenantID == 0 || strings.TrimSpace(k.SessionID) == "" {
		return errors.New("sandbox binding requires tenant and session")
	}
	if strings.ContainsAny(k.SessionID, "{}") {
		return errors.New("sandbox binding session must not contain braces")
	}
	for _, r := range k.SessionID {
		if unicode.IsControl(r) {
			return errors.New("sandbox binding session must not contain control characters")
		}
	}
	return nil
}

// SessionSandboxBinding records the remote sandbox assigned to a session.
type SessionSandboxBinding struct {
	Version    int            `json:"version"`
	Provider   RemoteProvider `json:"provider,omitempty"`
	TenantID   uint64         `json:"tenant_id"`
	SessionID  string         `json:"session_id"`
	SandboxID  string         `json:"sandbox_id"`
	TemplateID string         `json:"template_id"`
	CreatedAt  time.Time      `json:"created_at"`

View on GitHub (pinned to 988cbb0330)

Solutions

1. Strip enclosing braces before building the key, e.g. strings.Trim(id, "{}").
2. Sanitize session IDs at the ingress point and reject brace-containing IDs with a 400.
3. Ensure internal ID generators emit UUIDs without braces.

Example fix

// before
key := sandbox.SessionSandboxKey{TenantID: 7, SessionID: "{abc-123}"}
// after
key := sandbox.SessionSandboxKey{TenantID: 7, SessionID: strings.Trim(sessionID, "{}")}

var sessionIDRe = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)
if !sessionIDRe.MatchString(sessionID) {
    return errors.New("session id contains forbidden characters")
}

func safeSessionID(id string) bool { return !strings.ContainsAny(id, "{}") && strings.TrimSpace(id) != "" }

if err := key.Validate(); err != nil {
    if strings.Contains(err.Error(), "braces") {
        key.SessionID = strings.Trim(key.SessionID, "{}")
        return key.Validate()
    }
    return err
}

When it happens

Trigger: Passing a SessionSandboxKey whose SessionID contains '{' or '}' to Validate (directly or via Get, BeginTurn, EndTurn, WithLifecycleLock, validateBindingMatch), typically because the ID came from a URL template or JSON snippet.

Common situations: Client sends an ID copied with surrounding braces like "{abc-123}"; IDs generated from template strings that kept placeholder braces.

Related errors

• sandbox binding session must not contain control characters
• E2B timeout must be at least one second
• invalid sandbox type
• timeout cannot be negative
• memory limit cannot be negative

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/da8c21303c2f28b4. Report an issue: GitHub.