What causes "sandbox: write session input %s: %w" in Tencent/WeKnora?

Read the wrapped error for the provider-level cause (timeout, 4xx, 5xx).

sandbox: write session input %s: %w

Error message

sandbox: write session input %s: %w

What it means

After successfully creating the parent directory, WriteSessionInputFile writes the attachment bytes via m.client.WriteFile; failure is wrapped as "sandbox: write session input <path>". This is the actual upload of the file content into the remote sandbox failing.

Source

Thrown at internal/sandbox/session_manager.go:524

	if err := m.requireRemoteBackend(); err != nil {
		return err
	}
	if strings.TrimSpace(sessionID) == "" {
		return errors.New("sandbox: session ID required for input staging")
	}
	clean, err := cleanSessionInputPath(filePath)
	if err != nil {
		return err
	}
	handle, err := m.resolveSession(ctx, sessionID)
	if err != nil {
		return err
	}
	if err := ignoreExistingDir(m.client.MakeDir(ctx, handle, path.Dir(clean))); err != nil {
		return fmt.Errorf("sandbox: create input directory: %w", err)
	}
	if err := m.client.WriteFile(ctx, handle, clean, content); err != nil {
		return fmt.Errorf("sandbox: write session input %s: %w", clean, err)
	}
	return nil
}

// WriteSessionWorkspaceFile writes a model-authored file into the session's
// remote sandbox, provisioning the sandbox on first call. Paths must sit
// under /workspace and must not land in /workspace/input.
func (m *SessionBoundManager) WriteSessionWorkspaceFile(
	ctx context.Context, sessionID, filePath string, content []byte,
) error {
	if err := m.requireRemoteBackend(); err != nil {
		return err
	}
	if strings.TrimSpace(sessionID) == "" {
		return errors.New("sandbox: session ID required for workspace write")
	}
	clean, err := cleanSessionWorkspaceWritePath(filePath)
	if err != nil {

View on GitHub (pinned to 988cbb0330)

Solutions

Read the wrapped error for the provider-level cause (timeout, 4xx, 5xx).
Retry the write; if the sandbox expired, let resolveSession provision a fresh one.
Reduce attachment size or increase the HTTP timeout in config for large uploads.
Confirm the target path is writable in the sandbox image.

Example fix

// before
err := mgr.WriteSessionInputFile(ctx, sessionID, p, hugeBlob) // times out
// after
cfg.HTTPTimeout = 120 * time.Second // raise upload timeout
err := mgr.WriteSessionInputFile(ctx, sessionID, p, hugeBlob)

Defensive patterns

Strategy: retry

Validate before calling

// pre-check size and path before upload
if len(content) > maxUploadBytes {
    return fmt.Errorf("attachment %s exceeds %d bytes", name, maxUploadBytes)
}
if !path.IsAbs(path.Clean(target)) {
    return fmt.Errorf("attachment path must be absolute")
}

Try / catch

err := mgr.WriteSessionInputFile(ctx, sessionID, p, content)
if err != nil && strings.Contains(err.Error(), "write session input") {
    // transient upload failure: retry with backoff
    backoff := time.Second
    for i := 0; i < 3 && err != nil; i++ {
        time.Sleep(backoff)
        backoff *= 2
        err = mgr.WriteSessionInputFile(ctx, sessionID, p, content)
    }
}

Prevention

Raise cfg HTTPTimeout for large attachment uploads.
Upload promptly after staging decisions — long gaps let sandboxes expire.
Chunk very large files instead of one huge WriteFile.
Handle provider 429/5xx with exponential backoff.

When it happens

Trigger: Calling WriteSessionInputFile when client.WriteFile fails — provider API error, network interruption mid-upload, sandbox terminated during write, path rejected, or content exceeding size limits.

Common situations: Large attachment uploads timing out on slow networks, sandbox auto-reclaimed during a long transfer, provider 4xx/5xx responses, or writing to a read-only location.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/2ef786da76c75e52. Report an issue: GitHub.