abhigyanpatwari/GitNexus · critical · SandboxError

GitNexus MCP executable must stay outside {SANDBOX_WORKSPACE

Error message

GitNexus MCP executable must stay outside {SANDBOX_WORKSPACE}

What it means

Thrown by sandbox_mcp_config before building the sandboxed MCP server config. The GitNexus MCP entrypoint (the node script the sandboxed agent will invoke) must be an absolute path and must live strictly outside the sandbox workspace; if it were inside /workspace, the confined agent could overwrite or replace the very executable that powers its own tools, breaking the containment boundary. This is a SandboxError (a RuntimeError subclass).

Source

Thrown at eval/workflow_bench/runner_sessions.py:102

    "mcp__gitnexus__pdg_query",
    "mcp__gitnexus__route_map",
    "mcp__gitnexus__tool_map",
    "mcp__gitnexus__shape_check",
    "mcp__gitnexus__api_impact",
    "mcp__gitnexus__trace",
    "mcp__gitnexus__detect_changes",
)
GITNEXUS_MUTATING_TOOLS = ("mcp__gitnexus__rename",)
BUILTIN_AGENT_TOOLS = ("Read", "Grep", "Glob", "Edit", "Write", "Bash", "Skill")


def sandbox_mcp_config() -> str:
    """Credential-free MCP configuration using only the pinned harness runtime."""

    entrypoint = PurePosixPath(SANDBOX_GITNEXUS_ENTRYPOINT)
    workspace = PurePosixPath(SANDBOX_WORKSPACE)
    if not entrypoint.is_absolute() or entrypoint == workspace or workspace in entrypoint.parents:
        raise SandboxError(f"GitNexus MCP executable must stay outside {SANDBOX_WORKSPACE}")

    config = {
        "mcpServers": {
            "gitnexus": {
                "type": "stdio",
                "command": "/usr/bin/env",
                "args": [
                    "-i",
                    f"HOME={SANDBOX_HOME}",
                    f"TMPDIR={SANDBOX_TMP}",
                    f"GITNEXUS_HOME={SANDBOX_GITNEXUS_REGISTRY}",
                    f"GITNEXUS_MCP_ALLOWED_REPOS={SANDBOX_WORKSPACE}",
                    f"GITNEXUS_MCP_DEFAULT_REPO={SANDBOX_WORKSPACE}",
                    "PATH=/usr/local/bin:/usr/bin:/bin",
                    "LANG=C.UTF-8",
                    "GIT_TERMINAL_PROMPT=0",
                    SANDBOX_NODE,
                    SANDBOX_GITNEXUS_ENTRYPOINT,

View on GitHub (pinned to d540b00184)

Solutions

1. Install GitNexus into a directory outside /workspace (the harness default is /opt/gitnexus-style path via SANDBOX_GITNEXUS), so dist/cli/index.js is not under the workspace.
2. Set SANDBOX_GITNEXUS_ENTRYPOINT to an absolute path that is not /workspace and not beneath it.
3. Mount the MCP runtime read-only from a host path outside the workspace rather than installing it inside.
4. Rebuild the sandbox image with GitNexus in /opt or /usr/local.

Example fix

// before — GitNexus installed under the workspace
SANDBOX_GITNEXUS_ENTRYPOINT = '/workspace/gitnexus/dist/cli/index.js'  # -> raises

// after — install outside the workspace
SANDBOX_GITNEXUS_ENTRYPOINT = '/opt/gitnexus/dist/cli/index.js'

from pathlib import PurePosixPath

def entrypoint_outside_workspace(entrypoint: str, workspace: str = '/workspace') -> bool:
    ep = PurePosixPath(entrypoint)
    ws = PurePosixPath(workspace)
    return ep.is_absolute() and ep != ws and ws not in ep.parents

from pathlib import PurePosixPath

def entrypoint_outside_workspace(entrypoint: str, workspace: str = '/workspace') -> bool:
    ep = PurePosixPath(entrypoint)
    ws = PurePosixPath(workspace)
    return ep.is_absolute() and ep != ws and ws not in ep.parents

from eval.workflow_bench.proposer_sandbox import SandboxError
try:
    cfg = sandbox_mcp_config()
except SandboxError as e:
    if 'must stay outside' in str(e):
        # install/mount GitNexus outside /workspace, then retry
        raise
    raise

When it happens

Trigger: SANDBOX_GITNEXUS_ENTRYPOINT is not absolute, equals SANDBOX_WORKSPACE ('/workspace'), or has /workspace as a parent. I.e. the pinned MCP binary was installed under /workspace.

Common situations: GitNexus was installed into /workspace (e.g. npm install inside the worktree) so its dist/cli/index.js is under the workspace root; the entrypoint constant was overridden to a relative path; a misconfigured sandbox image mounted the install under /workspace.

Related errors

• generated artifact is not a regular non-symlink file: {path}
• generated artifact changed type while opening: {path}
• Insecure http:// LLM base URLs are only allowed for localhos
• {label} must be a real non-symlink directory: {path}
• {label} contains an unsafe path component: {relative}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/ea935c7375bbfdd8. Report an issue: GitHub.