{"record":{"id":"15d94e77b677eae8","repo":"Tencent/WeKnora","slug":"sandbox-create-workspace-directory-w","errorCode":null,"errorMessage":"sandbox: create workspace directory: %w","messagePattern":"sandbox: create workspace directory: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/session_manager.go","lineNumber":551,"sourceCode":"\tctx context.Context, sessionID, filePath string, content []byte,\n) error {\n\tif err := m.requireRemoteBackend(); err != nil {\n\t\treturn err\n\t}\n\tif strings.TrimSpace(sessionID) == \"\" {\n\t\treturn errors.New(\"sandbox: session ID required for workspace write\")\n\t}\n\tclean, err := cleanSessionWorkspaceWritePath(filePath)\n\tif err != nil {\n\t\treturn err\n\t}\n\thandle, err := m.resolveSession(ctx, sessionID)\n\tif err != nil {\n\t\treturn err\n\t}\n\tm.ensureSessionWorkspaceDirs(ctx, handle, SessionOutputRoot)\n\tif err := ignoreExistingDir(m.client.MakeDir(ctx, handle, path.Dir(clean))); err != nil {\n\t\treturn fmt.Errorf(\"sandbox: create workspace directory: %w\", err)\n\t}\n\tif err := m.client.WriteFile(ctx, handle, clean, content); err != nil {\n\t\treturn fmt.Errorf(\"sandbox: write session file %s: %w\", clean, err)\n\t}\n\treturn nil\n}\n\n// RemoveSessionInputPath deletes a staged attachment. It is a no-op when the\n// session has no live sandbox and never provisions one.\nfunc (m *SessionBoundManager) RemoveSessionInputPath(\n\tctx context.Context, sessionID, targetPath string,\n) error {\n\tif err := m.requireRemoteBackend(); err != nil {\n\t\treturn err\n\t}\n\tclean, err := cleanSessionInputPath(targetPath)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":533,"sourceCodeEnd":569,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/session_manager.go#L533-L569","documentation":"WriteSessionWorkspaceFile (for model-authored files) calls MakeDir on the parent of the cleaned target path after ensuring standard workspace dirs; failure is wrapped as \"sandbox: create workspace directory\". The workspace dirs under SessionOutputRoot are best-effort (errors ignored), so this error means the specific parent directory of the target file could not be created.","triggerScenarios":"Calling WriteSessionWorkspaceFile when MakeDir(path.Dir(clean)) fails — permission denied, invalid nested path, sandbox terminated mid-call, or provider API error.","commonSituations":"Model-generated paths containing illegal characters or escaping the workspace root, sandbox image with read-only workspace, quota exceeded, or a stale sandbox handle after expiry.","solutions":["Inspect the wrapped error to identify permission vs. path problems.","Sanitize/validate model-authored paths before writing (clean, restrict to workspace root).","Verify the sandbox is alive; re-resolve the session and retry.","Check provider disk quotas."],"exampleFix":"// before\np := modelOutput.Name() // may contain spaces/odd chars\nerr := mgr.WriteSessionWorkspaceFile(ctx, sessionID, p, data)\n// after\np := path.Join(\"/workspace\", path.Clean(sanitizeName(modelOutput.Name())))\nerr := mgr.WriteSessionWorkspaceFile(ctx, sessionID, p, data)","handlingStrategy":"validation","validationCode":"// sanitize model-authored paths before writing\nfunc sanitizeWorkspacePath(name string) string {\n    name = path.Clean(\"/\" + name) // anchor to root, drop ..\n    name = strings.Map(func(r rune) rune {\n        if unicode.IsLetter(r) || unicode.IsDigit(r) || r == '.' || r == '-' || r == '_' || r == '/' {\n            return r\n        }\n        return '_'\n    }, name)\n    return path.Join(\"/workspace\", name)\n}","typeGuard":null,"tryCatchPattern":"if err := mgr.WriteSessionWorkspaceFile(ctx, sessionID, p, data); err != nil {\n    if strings.Contains(err.Error(), \"create workspace directory\") {\n        return fmt.Errorf(\"workspace path %q rejected by sandbox: %w\", p, err)\n    }\n    return err\n}","preventionTips":["Never pass raw model output as a file path — always sanitize and anchor to the workspace root.","Use a sandbox image with a writable /workspace.","Validate nested depth and total path length against provider limits.","Confirm sandbox liveness before batch writes."],"tags":["go","sandbox","filesystem","path"],"backgroundTag":"remote-mkdir-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}