{"record":{"id":"4f0090666eae88fb","repo":"tinyhumansai/openhuman","slug":"refusing-to-delete-jail-outside-registry-base","errorCode":null,"errorMessage":"refusing to delete jail outside registry base: {}","messagePattern":"refusing to delete jail outside registry base: (.+?)","errorType":"exception","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"src/openhuman/sandbox/cwd_jail/registry.rs","lineNumber":279,"sourceCode":"\n        let resolved = record\n            .dir\n            .canonicalize()\n            .unwrap_or_else(|_| record.dir.clone());\n        let resolved_base = self\n            .base\n            .canonicalize()\n            .unwrap_or_else(|_| self.base.clone());\n        if !resolved.starts_with(&resolved_base) {\n            // Index is suspicious — don't touch anything on disk and\n            // leave the in-memory record alone too. The caller can\n            // diagnose and fix.\n            log::warn!(\n                \"[cwd_jail] refusing delete: dir {} not under base {}\",\n                resolved.display(),\n                resolved_base.display()\n            );\n            return Err(io::Error::new(\n                io::ErrorKind::PermissionDenied,\n                format!(\n                    \"refusing to delete jail outside registry base: {}\",\n                    resolved.display()\n                ),\n            ));\n        }\n\n        if record.dir.exists() {\n            fs::remove_dir_all(&record.dir)?;\n        }\n        // Disk side succeeded — now remove from the index and persist.\n        // If persist fails here the directory is already gone, so we\n        // can't fully roll back; we keep the in-memory removal aligned\n        // with disk reality and surface the error.\n        idx.records.remove(id);\n        if let Err(e) = self.persist(&idx) {\n            log::warn!(","sourceCodeStart":261,"sourceCodeEnd":297,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/sandbox/cwd_jail/registry.rs#L261-L297","documentation":"The registry refused to delete a jail whose on-disk directory (after canonicalization) does not lie under the registry base directory. This is a safety guard against a suspicious/corrupted index entry: delete would remove an arbitrary directory outside the managed base, so nothing on disk is touched and the in-memory record is left intact for the caller to diagnose. The record's stored dir and the registry base are the inputs at fault.","triggerScenarios":"Thrown at src/openhuman/sandbox/cwd_jail/registry.rs:279 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the jail record's dir field and the registry base to see how the entry diverged (manually edited index, moved base, symlinked dir)","Fix or remove the bad entry in the registry index manually rather than via delete","If the base was relocated intentionally, migrate the registry index to the new base"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}