Tencent/WeKnora · error

sandbox: session input path %q is outside %s

Error message

sandbox: session input path %q is outside %s

What it means

Validation guard in cleanSessionInputPath: the caller-supplied path, after path.Clean, does not equal SessionInputRoot and does not live under it. Used by WriteSessionInputFile and RemoveSessionInputPath to confine attachment input operations to the session input tree and block path escape.

Source

Thrown at internal/sandbox/session_manager.go:1010

func (m *SessionBoundManager) requireRemoteBackend() error {
	if m == nil {
		return ErrSandboxDisabled
	}
	m.mu.RLock()
	defer m.mu.RUnlock()
	if m.closed {
		return ErrSandboxDisabled
	}
	return nil
}

func cleanSessionInputPath(filePath string) (string, error) {
	clean := path.Clean(strings.TrimSpace(filePath))
	if clean == SessionInputRoot || strings.HasPrefix(clean, SessionInputRoot+"/") {
		return clean, nil
	}
	return "", fmt.Errorf(
		"sandbox: session input path %q is outside %s",
		filePath, SessionInputRoot,
	)
}

// cleanSessionWorkspaceWritePath keeps model-authored writes inside the
// session workspace and out of the attachment tree. Validation is lexical
// (path.Clean plus prefix checks), matching cleanSessionWorkDir.
func cleanSessionWorkspaceWritePath(filePath string) (string, error) {
	clean := path.Clean(strings.TrimSpace(filePath))
	if !path.IsAbs(clean) || clean == "." || clean == "/" {
		return "", fmt.Errorf("sandbox: workspace write path %q must be an absolute file path", filePath)
	}
	if clean == SessionWorkspaceRoot || clean == SessionOutputRoot || clean == SessionInputRoot {
		return "", fmt.Errorf("sandbox: workspace write path %q is a directory, not a file", filePath)
	}
	if !strings.HasPrefix(clean, SessionWorkspaceRoot+"/") {
		return "", fmt.Errorf("sandbox: workspace write path %q is outside %s", filePath, SessionWorkspaceRoot)

View on GitHub (pinned to 988cbb0330)

Solutions

1. Prefix the path with the session input root before calling
2. Reject the caller-supplied path; do not attempt to 'fix' it by stripping components

When it happens

Trigger: Thrown at internal/sandbox/session_manager.go:1010 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/241d7caf61f0a6ec. Report an issue: GitHub.