{"record":{"id":"4cf47c035bfb4fbf","repo":"HKUDS/Vibe-Trading","slug":"path-p-r-is-outside-allowed-purpose-roots-d","errorCode":null,"errorMessage":"Path {p!r} is outside allowed {purpose} roots.\n{_describe_roots(roots)}\nSet {_ALLOWED_FILE_ROOTS_ENV} to add an import directory. {_ENV_SCOPE_HINT}","messagePattern":"Path (.+?) is outside allowed (.+?) roots\\.\n(.+?)\nSet (.+?) to add an import directory\\. (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"agent/src/tools/path_utils.py","lineNumber":305,"sourceCode":"        p: User-supplied path. `~` expansion is supported.\n        purpose: Human-readable purpose for error messages.\n\n    Returns:\n        Absolute resolved path inside an allowed import root.\n\n    Raises:\n        ValueError: If `p` is a UNC share or resolves outside all allowed\n            import roots.\n    \"\"\"\n    _rejects_unc(p)\n    resolved = _import_candidate(p)\n\n    roots = allowed_file_roots()\n    for root in roots:\n        if resolved.is_relative_to(root):\n            return resolved\n\n    raise ValueError(\n        f\"Path {p!r} is outside allowed {purpose} roots.\\n\"\n        f\"{_describe_roots(roots)}\\n\"\n        f\"Set {_ALLOWED_FILE_ROOTS_ENV} to add an import directory. {_ENV_SCOPE_HINT}\"\n    )\n\n\ndef safe_user_path(p: str) -> Path:\n    \"\"\"Validate a user-supplied broker/export file path.\n\n    Args:\n        p: User-supplied path. `~` expansion is supported.\n\n    Returns:\n        Absolute resolved path inside an allowed import root.\n\n    Raises:\n        ValueError: If `p` is a UNC share or resolves outside all allowed\n            import roots.","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/HKUDS/Vibe-Trading/blob/80ffdda44c5c4db0dd84d70e051cca591cea67df/agent/src/tools/path_utils.py#L287-L323","documentation":"_safe_import_path (backing safe_user_path / safe_document_path) resolves the path and requires it under one of the allowed file roots; otherwise it raises with the list of allowed roots plus a hint to extend them via the allowed-file-roots environment variable.","triggerScenarios":"Importing a user module or document from a directory not in allowed_file_roots(), e.g. ~/my_data when only /workspace/data is allowed.","commonSituations":"Running the agent under systemd/docker where HOME differs, per-user data directories, or forgetting to configure import dirs at deploy time.","solutions":["Move the file under an existing allowed root (listed in the error message)","Set the allowed-file-roots env var to include the import directory, scoped per the env hint","Check the env var in the exact process running the agent"],"exampleFix":"# before\nsafe_user_path(\"~/my_data/mod.py\")\n# after\n# AGENT_ALLOWED_FILE_ROOTS=/data\ntool.execute(file_path=\"/data/my_data/mod.py\")","handlingStrategy":"validation","validationCode":"from agent.src.tools.path_utils import allowed_file_roots\ncand = Path(p).expanduser().resolve()\nif not any(cand.is_relative_to(r) for r in allowed_file_roots()):\n    raise ArgumentError(f\"move {p} under an allowed root or set the env var\")","typeGuard":"def is_importable_path(p: str) -> bool:\n    c = Path(p).expanduser().resolve()\n    return any(c.is_relative_to(r) for r in allowed_file_roots())","tryCatchPattern":"try:\n    safe = safe_user_path(module_path)\nexcept ValueError as e:\n    if \"outside allowed\" in str(e):\n        configure_file_roots([str(cand.parent)]); safe = safe_user_path(module_path)","preventionTips":["Set the allowed-file-roots env var at deploy time","Keep user data under one canonical directory","Remember HOME may differ under systemd/docker"],"tags":["path-validation","import","environment-variable"],"backgroundTag":"missing-env-var","analyzedSha":"80ffdda44c5c4db0dd84d70e051cca591cea67df","analyzedAt":"2026-08-28T12:46:38.989Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}