{"record":{"id":"0c99c0493410f756","repo":"mastra-ai/mastra","slug":"invalid-mount-path-mountpath-root-path-is","errorCode":null,"errorMessage":"Invalid mount path: ${mountPath}. Root path \"/\" is not allowed.","messagePattern":"Invalid mount path: (.+?)\\. Root path \"/\" is not allowed\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/workspace/sandbox/local-sandbox.ts","lineNumber":69,"sourceCode":" * `os.tmpdir` is `undefined`. Evaluating it at import time crashes Studio boot.\n * See https://github.com/mastra-ai/mastra/issues/18519.\n */\nexport function getMarkerDir(): string {\n  return path.join(os.tmpdir(), '.mastra-mounts');\n}\n\n/** Allowlist pattern for mount paths — absolute path with safe characters only. */\nconst SAFE_MOUNT_PATH = /^\\/[a-zA-Z0-9_.\\-/]+$/;\n\nfunction validateMountPath(mountPath: string): void {\n  if (!SAFE_MOUNT_PATH.test(mountPath)) {\n    throw new Error(\n      `Invalid mount path: ${mountPath}. Must be an absolute path with alphanumeric, dash, dot, underscore, or slash characters only.`,\n    );\n  }\n  const segments = mountPath.split('/').filter(Boolean);\n  if (segments.length === 0) {\n    throw new Error(`Invalid mount path: ${mountPath}. Root path \"/\" is not allowed.`);\n  }\n  if (segments.some(seg => seg === '.' || seg === '..')) {\n    throw new Error(`Invalid mount path: ${mountPath}. Path segments cannot be \".\" or \"..\".`);\n  }\n}\n\n/** Canonicalize mount path so `/data`, `/data/`, `//data` all resolve to `/data`. */\nfunction normalizeMountPath(mountPath: string): string {\n  return `/${mountPath.split('/').filter(Boolean).join('/')}`;\n}\n\n// =============================================================================\n// Local Sandbox\n// =============================================================================\n\n/**\n * Local sandbox provider configuration.\n */","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/core/src/workspace/sandbox/local-sandbox.ts#L51-L87","documentation":"After the character allowlist passes, validateMountPath rejects the root path `/` itself. Mounting or unmounting the filesystem root is never allowed — it would shadow the entire sandbox filesystem. Only subdirectory mount points are valid.","triggerScenarios":"Calling `sandbox.mount('/')` or `sandbox.unmount('/')`; passing a variable that defaults to or resolves to `/` (e.g. an empty WORKDIR env var collapsed to root).","commonSituations":"Config value like `MOUNT_PATH=` falling back to `/`; mistakenly thinking mounting at root is a way to expose the whole host directory; programmatic path computation producing `/` after normalization.","solutions":["Mount at a specific subdirectory instead, e.g. `/data` or `/workspace`","Add a pre-check: reject mountPath === '/' before calling mount/unmount","Fix the config/env source so the mount point is a real named directory"],"exampleFix":"// before\nconst mountPath = process.env.MOUNT_PATH ?? '/';\nsandbox.mount(mountPath);\n// after\nconst mountPath = process.env.MOUNT_PATH || '/data';\nif (mountPath === '/') throw new Error('Root path \"/\" is not an allowed mount point');\nsandbox.mount(mountPath);","handlingStrategy":"validation","validationCode":"if (mountPath === '/') throw new Error('Root path \"/\" is not an allowed mount point; use a named directory like /data');","typeGuard":null,"tryCatchPattern":"try {\n  await sandbox.mount(mountPath);\n} catch (err) {\n  if (/Root path/.test(String(err?.message))) {\n    throw new Error(`MOUNT_PATH was '/'; set it to a real directory such as /data`);\n  }\n  throw err;\n}","preventionTips":["Never default mount configuration to '/'; require an explicit named directory","Validate env-derived config (empty strings collapsing to defaults) at startup","Document allowed mount roots in your config schema and enforce with a refine/regex"],"tags":["validation","filesystem","mount","path"],"backgroundTag":"invalid-path-format","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}