{"record":{"id":"9cdfda0c5e62dd91","repo":"Tencent/WeKnora","slug":"sandbox-shell-exec-requires-the-remote-sandbox-pr","errorCode":null,"errorMessage":"sandbox: shell_exec requires the remote sandbox provider (current mode: %s)","messagePattern":"sandbox: shell_exec requires the remote sandbox provider \\(current mode: (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sandbox/session_manager.go","lineNumber":715,"sourceCode":") (*ExecuteResult, error) {\n\treturn m.ExecShellCommandWithOptions(ctx, sessionID, command, ShellExecOptions{\n\t\tWorkDir: workDir,\n\t\tTimeout: timeout,\n\t\tEnv:     env,\n\t})\n}\n\n// ExecShellCommandWithOptions runs a shell command with install-only options.\n// Fallback is explicitly refused so even privileged installer calls never\n// escape onto the WeKnora host machine.\nfunc (m *SessionBoundManager) ExecShellCommandWithOptions(\n\tctx context.Context,\n\tsessionID string,\n\tcommand string,\n\topts ShellExecOptions,\n) (*ExecuteResult, error) {\n\tif err := m.requireRemoteBackend(); err != nil {\n\t\treturn nil, fmt.Errorf(\n\t\t\t\"sandbox: shell_exec requires the remote sandbox provider (current mode: %s)\",\n\t\t\tm.GetType(),\n\t\t)\n\t}\n\tif strings.TrimSpace(sessionID) == \"\" {\n\t\treturn nil, errors.New(\"sandbox: session_id required for ExecShellCommand\")\n\t}\n\tif strings.TrimSpace(command) == \"\" {\n\t\treturn nil, errors.New(\"sandbox: command required for ExecShellCommand\")\n\t}\n\ttimeout := opts.Timeout\n\tif timeout <= 0 {\n\t\ttimeout = m.config.DefaultTimeout\n\t}\n\tif timeout <= 0 {\n\t\ttimeout = DefaultTimeout\n\t}\n","sourceCodeStart":697,"sourceCodeEnd":733,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/sandbox/session_manager.go#L697-L733","documentation":"Guard error raised by ExecShellCommandWithOptions when requireRemoteBackend determines the sandbox manager is not configured for the remote provider (disabled, closed, or wrong backend mode). Shell execution is refused so privileged installer commands never fall back to running on the WeKnora host. The current mode is reported in the message.","triggerScenarios":"Thrown at internal/sandbox/session_manager.go:715 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the remote sandbox provider before invoking shell commands","Route the command to the correct backend for the current mode","Treat as fatal for installer flows; do not silently fall back to host execution"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}