{"record":{"id":"31973e7e98cc2845","repo":"Tencent/WeKnora","slug":"sandbox-write-install-file-s-w","errorCode":null,"errorMessage":"sandbox: write install file %s: %w","messagePattern":"sandbox: write install file (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/session_manager.go","lineNumber":663,"sourceCode":"\tif strings.TrimSpace(sessionID) == \"\" {\n\t\treturn errors.New(\"sandbox: session ID required for file staging\")\n\t}\n\tclean := path.Clean(strings.TrimSpace(filePath))\n\tif clean != SkillsImageRoot && !strings.HasPrefix(clean, SkillsImageRoot+\"/\") {\n\t\treturn fmt.Errorf(\"sandbox: install file path %q is outside %s\", filePath, SkillsImageRoot)\n\t}\n\thandle, err := m.resolveSession(ctx, sessionID)\n\tif err != nil {\n\t\treturn err\n\t}\n\t// resetSkillDir already created this folder with mkdir -p. Cube's MakeDir\n\t// then reports the existing directory as an error; ignoreExistingDir keeps\n\t// that from aborting the seed of SKILL.md.\n\tif err := ignoreExistingDir(m.client.MakeDir(ctx, handle, path.Dir(clean))); err != nil {\n\t\treturn fmt.Errorf(\"sandbox: create install directory: %w\", err)\n\t}\n\tif err := m.client.WriteFile(ctx, handle, clean, content); err != nil {\n\t\treturn fmt.Errorf(\"sandbox: write install file %s: %w\", clean, err)\n\t}\n\treturn nil\n}\n\n// ShellExecOptions carries per-call shell execution knobs. The install-only\n// flags are explicit so skill image maintenance can write under /opt without\n// loosening work_dir or user privileges for ordinary chat sessions.\ntype ShellExecOptions struct {\n\tWorkDir string\n\tTimeout time.Duration\n\tEnv     map[string]string\n\n\t// AllowSkillsRoot lets installer calls work inside the skills image root.\n\t// See cleanSessionWorkDir for why the work_dir allowlist is lexical only.\n\t// Never set this from a model-authored tool such as shell_exec.\n\tAllowSkillsRoot bool\n\t// AsRoot is reserved for install/maintenance commands that need to write\n\t// outside /workspace; ordinary sessions must keep the provider default user.","sourceCodeStart":645,"sourceCodeEnd":681,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/session_manager.go#L645-L681","documentation":"Thrown in WriteSessionFile when the actual file write (upload) of an install file into the skills image root of the remote sandbox fails. The path was already validated to be under SkillsImageRoot and the session resolved, so the wrapped error is the remote provider's write/upload failure (I/O, quota, or connection).","triggerScenarios":"Thrown at internal/sandbox/session_manager.go:663 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the wrapped provider error for transient vs persistent failure","Retry the write for transient network errors","Confirm the file content size fits sandbox storage limits"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}