{"record":{"id":"b225df8fadcafa10","repo":"shareAI-lab/learn-claude-code","slug":"path-escapes-workspace-p-b225df","errorCode":null,"errorMessage":"Path escapes workspace: {p}","messagePattern":"Path escapes workspace: (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"agents/s10_team_protocols.py","lineNumber":300,"sourceCode":"        if not self.config[\"members\"]:\n            return \"No teammates.\"\n        lines = [f\"Team: {self.config['team_name']}\"]\n        for m in self.config[\"members\"]:\n            lines.append(f\"  {m['name']} ({m['role']}): {m['status']}\")\n        return \"\\n\".join(lines)\n\n    def member_names(self) -> list:\n        return [m[\"name\"] for m in self.config[\"members\"]]\n\n\nTEAM = TeammateManager(TEAM_DIR)\n\n\n# -- Base tool implementations (these base tools are unchanged from s02) --\ndef _safe_path(p: str) -> Path:\n    path = (WORKDIR / p).resolve()\n    if not path.is_relative_to(WORKDIR):\n        raise ValueError(f\"Path escapes workspace: {p}\")\n    return path\n\n\ndef _run_bash(command: str) -> str:\n    dangerous = [\"rm -rf /\", \"sudo\", \"shutdown\", \"reboot\", \"> /dev/\"]\n    if any(d in command for d in dangerous):\n        return \"Error: Dangerous command blocked\"\n    try:\n        r = subprocess.run(\n            command, shell=True, cwd=WORKDIR,\n            capture_output=True, text=True, timeout=120,\n        )\n        out = (r.stdout + r.stderr).strip()\n        return out[:50000] if out else \"(no output)\"\n    except subprocess.TimeoutExpired:\n        return \"Error: Timeout (120s)\"\n\n","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/shareAI-lab/learn-claude-code/blob/985456f4adea6f4df8fbad4112245dbd97444eae/agents/s10_team_protocols.py#L282-L318","documentation":"Identical guard at agents/s10_team_protocols.py:300 — this stage adds structured team protocols on top of s09 and reuses _safe_path for the base file tools. Any file tool path that resolves outside WORKDIR (Path.cwd() at launch) is rejected.","triggerScenarios":"File tool calls carrying absolute paths or traversals, typically paths copied from protocol messages, handoff notes, or teammate configs. Symlink escape and wrong launch cwd are the other two routes.","commonSituations":"Protocol handoffs that reference files by absolute path; models forwarding those verbatim. Harness launched from a parent directory so WORKDIR is too narrow.","solutions":["Make handoff/protocol messages use workspace-relative paths","Convert absolute paths to relative before file tool calls","Start the agent with cwd = workspace root"],"exampleFix":"# before\n_safe_path(\"/home/beagle/proj/notes.md\")  # ValueError: Path escapes workspace\n\n# after\n_safe_path(\"notes.md\")","handlingStrategy":"validation","validationCode":"import os\nfrom pathlib import Path\n\ndef relay_safe_path(p: str, workdir: Path) -> str | None:\n    try:\n        cand = Path(p)\n        abs_c = (cand if cand.is_absolute() else workdir / cand).resolve()\n        return os.path.relpath(abs_c, workdir) if abs_c.is_relative_to(workdir) else None\n    except (OSError, ValueError, RuntimeError):\n        return None\n\nrel = relay_safe_path(handoff_path, WORKDIR)\nassert rel, \"handoff path escapes workspace; request a relative path in the protocol\"","typeGuard":"def is_protocol_safe_path(p: object, workdir) -> bool:\n    if not isinstance(p, str) or not p:\n        return False\n    try:\n        return (workdir / p).resolve().is_relative_to(workdir)\n    except (OSError, RuntimeError):\n        return False","tryCatchPattern":"try:\n    path = _safe_path(p)\nexcept ValueError:\n    return f\"Protocol path {p} rejected. Handoffs must reference workspace-relative paths.\"","preventionTips":["Encode relative paths in the protocol/handoff message format itself","Convert any absolute path to relpath at the receiving end before tool use","Validate handoff payloads against the sandbox before broadcasting them"],"tags":["security","path-traversal","sandbox","team-protocols","python"],"backgroundTag":null,"analyzedSha":"985456f4adea6f4df8fbad4112245dbd97444eae","analyzedAt":"2026-08-14T22:02:26.028Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}