{"record":{"id":"a205de5061510b22","repo":"Tencent/WeKnora","slug":"sandbox-is-not-configured","errorCode":null,"errorMessage":"sandbox is not configured","messagePattern":"sandbox is not configured","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/agent/skills/manager.go","lineNumber":349,"sourceCode":"\t\treturn \"\", false\n\t}\n\tdir = strings.TrimSpace(dir)\n\treturn dir, dir != \"\"\n}\n\n// ExecuteScript executes a script from a skill in the sandbox\nfunc (m *Manager) ExecuteScript(ctx context.Context, skillName, scriptPath string, args []string, stdin string) (*sandbox.ExecuteResult, error) {\n\tif !m.enabled {\n\t\treturn nil, fmt.Errorf(\"skills are not enabled\")\n\t}\n\n\tif !m.isSkillAllowed(skillName) {\n\t\treturn nil, fmt.Errorf(\"skill not allowed: %s\", skillName)\n\t}\n\n\t// Verify sandbox manager is available\n\tif m.sandboxMgr == nil {\n\t\treturn nil, fmt.Errorf(\"sandbox is not configured\")\n\t}\n\n\tsource := m.resolveSource(skillName)\n\n\t// Get the skill base path\n\tbasePath, err := source.GetSkillBasePath(skillName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Prepare execution config\n\tlogger.Info(ctx, \"[Tool][ExecuteScript]:Prepare execution config\")\n\tsessionID, _ := types.SessionIDFromContext(ctx)\n\n\t// Compute the artifact output directory. All skills share the same root\n\t// directory (/workspace/output/) to enable collaboration and file sharing\n\t// between different skill executions in the same session.\n\t// Skill scripts read the directory via WEKNORA_SKILL_OUTPUT_DIR; the","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/agent/skills/manager.go#L331-L367","documentation":"ExecuteScript refuses to run when the skills manager was constructed without a sandbox manager (m.sandboxMgr == nil). Skill scripts only run inside the sandbox, so without that dependency the manager can list/read skills but cannot execute them. It is an internal invariant/availability check, not a user-input error.","triggerScenarios":"Calling Manager.ExecuteScript on a manager built via NewManager (or config path) that never received/wired a sandbox.Manager — e.g. skills enabled in config but sandbox subsystem disabled or failed to initialize.","commonSituations":"Deployments with skills enabled but sandbox execution disabled; partial startup where sandbox init failed silently; tests constructing a manager without a sandbox; running in a mode (e.g. no-Docker host) that leaves sandboxMgr nil.","solutions":["Enable and correctly initialize the sandbox manager so it is injected into the skills manager before ExecuteScript is called","Check startup logs for sandbox initialization failure and fix the underlying cause (Docker/runtime unavailable, bad sandbox config)","Verify the skills manager is constructed with the sandbox dependency, not a zero-value or partially initialized Manager","If sandbox execution is intentionally unavailable, surface capability to the model instead of calling execute_skill_script"],"exampleFix":"// before\nmgr, _ := skills.NewManager(cfg) // sandboxMgr nil when sandbox disabled\nmgr.ExecuteScript(ctx, \"pdf\", \"scripts/run.py\", nil, \"\")\n// after\ncfg.SandboxManager = sandboxMgr // ensure sandbox is wired in\nmgr, _ := skills.NewManager(cfg)\nif err := mgr.ExecuteScript(ctx, \"pdf\", \"scripts/run.py\", nil, \"\"); err != nil {\n    log.Fatal(err)\n}","handlingStrategy":"try-catch","validationCode":"if mgr == nil || mgr.SandboxMgrMissing() { // or check capability before executing\n    return fmt.Errorf(\"sandbox execution unavailable\")\n}","typeGuard":"func sandboxReady(m *skills.Manager) bool {\n    return m != nil && m.SandboxManager() != nil\n}","tryCatchPattern":"cfg, err := mgr.ExecuteScript(ctx, skill, path, args, stdin)\nif err != nil {\n    if strings.Contains(err.Error(), \"sandbox is not configured\") {\n        // degrade: report capability unavailable, fall back to shell_exec\n        return nil, errSandboxUnavailable\n    }\n    return err\n}","preventionTips":["Always construct the skills manager with an initialized sandbox manager","Add a startup health check that fails fast if skills are enabled but the sandbox is nil","Gate tool registration on sandbox availability so execute_skill_script is only exposed when usable","Cover the nil-sandbox path in unit tests"],"tags":["go","sandbox","configuration","dependency-injection"],"backgroundTag":"sandbox-not-configured","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}