{"record":{"id":"ca596f704152d8c5","repo":"zed-industries/zed","slug":"failed-to-provide-writable-sandbox-path-it-no","errorCode":null,"errorMessage":"failed to provide writable sandbox path {}: it no longer exists","messagePattern":"failed to provide writable sandbox path (.+?): it no longer exists","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/sandbox/src/linux_bubblewrap.rs","lineNumber":625,"sourceCode":"            \"too many writable binds to validate ({} > {MAX_VALIDATED_BINDS})\",\n            writable_dirs.len()\n        );\n    }\n\n    // Every writable path must already exist: `bwrap` can't bind a nonexistent\n    // source, and the command can't create it either (its parent is read-only\n    // inside the sandbox). Callers hand us captured canonical paths whose\n    // inodes were pinned at policy-construction time, so a missing path here\n    // means the location vanished since capture. Never create it with the\n    // agent's ambient permissions — recreating from path text would bind a\n    // fresh, unapproved object in place of the pinned one (and historically\n    // this materialized bogus paths, e.g. a granted *file* path springing into\n    // existence as a directory). Running anyway would give the command silently\n    // less access than it believes it has — so fail closed with a clear error.\n    if !permissions.allow_fs_write {\n        for directory in writable_dirs {\n            if !directory.exists() {\n                bail!(\n                    \"failed to provide writable sandbox path {}: it no longer exists\",\n                    directory.display()\n                );\n            }\n        }\n    }\n\n    let bwrap = resolve_bwrap().map_err(|status| anyhow!(status.describe()))?;\n    let proxy_socket_sandbox_path = match permissions.network {\n        NetworkAccess::LocalhostPort(_) => Some(unique_proxy_socket_sandbox_path()),\n        NetworkAccess::None | NetworkAccess::All => None,\n    };\n    let mut bwrap_args = build_bwrap_args_with_sandbox_paths(\n        writable_dirs,\n        protected_paths,\n        permissions,\n        cwd,\n        proxy_socket_path,","sourceCodeStart":607,"sourceCodeEnd":643,"githubUrl":"https://github.com/zed-industries/zed/blob/5a9b9558db01a6b906cec2fb70a797affdc58cdd/crates/sandbox/src/linux_bubblewrap.rs#L607-L643","documentation":"wrap_invocation validates writable bind paths before running bwrap; a captured writable path no longer exists on disk (it was removed after the sandbox policy captured it), and bwrap cannot bind a nonexistent source, so sandbox setup fails rather than recreating the path with ambient permissions.","triggerScenarios":"Thrown at crates/sandbox/src/linux_bubblewrap.rs:625 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-run the task so sandbox policy re-captures current paths","Identify what deleted the directory (build clean, tmp reaping) and exclude it from writable paths","Report the bug if the path should have persisted"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5a9b9558db01a6b906cec2fb70a797affdc58cdd","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}