{"record":{"id":"beb05c11bf97c582","repo":"shareAI-lab/learn-claude-code","slug":"path-escapes-workspace-p-beb05c","errorCode":null,"errorMessage":"Path escapes workspace: {p}","messagePattern":"Path escapes workspace: (.+?)","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"agents/s11_autonomous_agents.py","lineNumber":386,"sourceCode":"        if not self.config[\"members\"]:\n            return \"No teammates.\"\n        lines = [f\"Team: {self.config['team_name']}\"]\n        for m in self.config[\"members\"]:\n            lines.append(f\"  {m['name']} ({m['role']}): {m['status']}\")\n        return \"\\n\".join(lines)\n\n    def member_names(self) -> list:\n        return [m[\"name\"] for m in self.config[\"members\"]]\n\n\nTEAM = TeammateManager(TEAM_DIR)\n\n\n# -- Base tool implementations (these base tools are unchanged from s02) --\ndef _safe_path(p: str) -> Path:\n    path = (WORKDIR / p).resolve()\n    if not path.is_relative_to(WORKDIR):\n        raise ValueError(f\"Path escapes workspace: {p}\")\n    return path\n\n\ndef _run_bash(command: str) -> str:\n    dangerous = [\"rm -rf /\", \"sudo\", \"shutdown\", \"reboot\", \"> /dev/\"]\n    if any(d in command for d in dangerous):\n        return \"Error: Dangerous command blocked\"\n    try:\n        r = subprocess.run(\n            command, shell=True, cwd=WORKDIR,\n            capture_output=True, text=True, timeout=120,\n        )\n        out = (r.stdout + r.stderr).strip()\n        return out[:50000] if out else \"(no output)\"\n    except subprocess.TimeoutExpired:\n        return \"Error: Timeout (120s)\"\n\n","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/shareAI-lab/learn-claude-code/blob/985456f4adea6f4df8fbad4112245dbd97444eae/agents/s11_autonomous_agents.py#L368-L404","documentation":"The same sandbox guard at agents/s11_autonomous_agents.py:386 in the autonomous long-running agent. Because this agent runs unattended for long stretches, a path rejection here will typically be retried by the loop until context fills — the guard semantics are unchanged from s09/s10 (_safe_path over WORKDIR).","triggerScenarios":"Autonomous turns where the model drifts to absolute paths (often after many compactions or after copying paths from earlier tool output), `../` traversals, or symlinks pointing outside the workspace. A wrong launch cwd makes every nontrivial relative target escape too.","commonSituations":"Long autonomous sessions where earlier absolute paths keep being re-quoted. Workspaces containing node_modules-style symlink farms. Unattended runs launched from cron/shell with an unexpected cwd.","solutions":["Reinforce relative-path discipline in the system prompt for long-running loops","Prune absolute-path strings from context (compact) so the model stops copying them","Verify launch cwd in the runner script before starting the loop"],"exampleFix":"# before\n_safe_path(\"/var/data/session_9.json\")  # ValueError: Path escapes workspace\n\n# after\n_safe_path(\"data/session_9.json\")","handlingStrategy":"validation","validationCode":"import os\nfrom pathlib import Path\n\ndef autonomous_safe_rel(p: str, workdir: Path) -> str | None:\n    try:\n        cand = Path(p)\n        abs_c = (cand if cand.is_absolute() else workdir / cand).resolve()\n        return os.path.relpath(abs_c, workdir) if abs_c.is_relative_to(workdir) else None\n    except (OSError, ValueError, RuntimeError):\n        return None\n\nrel = autonomous_safe_rel(next_path, WORKDIR)\nif rel is None:\n    log(f\"dropping escaping path {next_path}\"); next_path = None","typeGuard":"def is_loop_safe_path(p: object, workdir) -> bool:\n    if not isinstance(p, str) or not p:\n        return False\n    try:\n        return (workdir / p).resolve().is_relative_to(workdir)\n    except (OSError, RuntimeError):\n        return False","tryCatchPattern":"try:\n    path = _safe_path(p)\nexcept ValueError:\n    log(f\"sandbox rejection: {p}\")\n    return f\"Path {p} escapes the workspace. Use paths relative to {WORKDIR}. Do not retry unchanged.\"","preventionTips":["For unattended loops, log every sandbox rejection so failures are auditable","Compact away absolute-path strings so the model stops re-quoting them","Assert the launch cwd equals the workspace in the runner before entering the loop"],"tags":["security","path-traversal","sandbox","autonomous-agents","python"],"backgroundTag":null,"analyzedSha":"985456f4adea6f4df8fbad4112245dbd97444eae","analyzedAt":"2026-08-14T22:02:26.028Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}