{"record":{"id":"7e75b8646a14a7c8","repo":"abhigyanpatwari/GitNexus","slug":"candidate-sandbox-does-not-bind-the-requested-clon","errorCode":null,"errorMessage":"candidate sandbox does not bind the requested clone","messagePattern":"candidate sandbox does not bind the requested clone","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"critical","filePath":"eval/workflow_bench/evolution.py","lineNumber":380,"sourceCode":"\ndef candidate_overlay_digest(overlay: Path) -> str:\n    digest, _ = candidate_overlay_payload(overlay)\n    return digest\n\n\ndef apply_candidate_overlay(\n    overlay: Path,\n    worktree: Path,\n    *,\n    sandbox: SandboxSession,\n) -> str:\n    \"\"\"Safely copy and commit a prompt candidate inside its outer sandbox.\"\"\"\n\n    overlay = overlay.expanduser().absolute()\n    expected_clone = Path(os.path.abspath(worktree.expanduser()))\n    sandbox_clone = Path(os.path.abspath(sandbox.clone.expanduser()))\n    if sandbox_clone != expected_clone:\n        raise ValueError(\"candidate sandbox does not bind the requested clone\")\n    digest, payload = candidate_overlay_payload(overlay)\n    relative_paths: list[str] = []\n    for relative, content in payload:\n        _replace_regular_file(worktree, relative, content)\n        relative_paths.append(relative.as_posix())\n\n    mkdir_command = [\"/bin/mkdir\", \"-p\", f\"{SANDBOX_TMP}/wfbench-empty-hooks\"]\n    mkdir_result = sandbox.run(\n        mkdir_command,\n        timeout=60,\n        env=build_sandbox_environment(),\n    )\n    if not mkdir_result.ok:\n        raise ManagedProcessError(mkdir_command, mkdir_result)\n\n    command, added = _sandbox_overlay_git(sandbox, [\"add\", \"--\", *relative_paths])\n    if not added.ok:\n        raise ManagedProcessError(command, added)","sourceCodeStart":362,"sourceCodeEnd":398,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/evolution.py#L362-L398","documentation":"Thrown by apply_candidate_overlay (evolution.py:380) when the sandbox's bound clone (os.path.abspath(sandbox.clone)) does not equal the expected clone (os.path.abspath(worktree)). The harness refuses to write overlay bytes unless the sandbox session is bound to exactly the clone being modified, so that the staged writes land in the sandboxed clone and nowhere else.","triggerScenarios":"The caller passes a worktree path that differs from sandbox.clone — a different directory, an unresolved symlink, or a relative-vs-absolute mismatch after abspath normalization. Even a trailing-slash or symlink difference that abspath does not collapse will trip it.","commonSituations":"Creating the sandbox with one clone path and passing a different (or symlinked) worktree to apply_candidate_overlay; mixing a relative worktree with an absolute sandbox.clone; reusing a sandbox session across two different clones.","solutions":["Pass exactly the same clone path used to create the sandbox session as worktree (both absolute, both non-symlinked).","Compute both via os.path.abspath before comparison so they normalize identically.","Use sandbox.clone directly as the worktree argument."],"exampleFix":"# before: worktree differs from the sandbox's bound clone\nsandbox = prepare_sandbox(clone=Path('repo-a'))\napply_candidate_overlay(overlay, Path('repo-b'), sandbox=sandbox)  # mismatch\n\n# after: use the sandbox's own clone\nwith prepare_sandbox(clone=Path('repo-a').resolve()) as sandbox:\n    apply_candidate_overlay(overlay, sandbox.clone, sandbox=sandbox)","handlingStrategy":"validation","validationCode":"import os\nfrom pathlib import Path\n\ndef sandbox_binds_clone(sandbox, worktree: Path) -> bool:\n    return os.path.abspath(sandbox.clone.expanduser()) == os.path.abspath(worktree.expanduser())","typeGuard":"null","tryCatchPattern":"try:\n    apply_candidate_overlay(overlay, worktree, sandbox=sandbox)\nexcept ValueError as exc:\n    if 'does not bind the requested clone' in str(exc):\n        # pass sandbox.clone as worktree, then retry\n        ...","preventionTips":["Always pass sandbox.clone as the worktree argument.","Resolve both clone and worktree to absolute real paths before comparison.","Never reuse one sandbox session across two different clones."],"tags":["sandbox","config","benchmark","trust-boundary"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}