paperclipai/paperclip · error

Daytona ${label} command failed (exit ${result.exitCode ?? "

Error message

Daytona ${label} command failed (exit ${result.exitCode ?? "unknown"})${detail ? `: ${detail}` : ""}

What it means

Thrown by assertSandboxCommandOk when a command executed inside the Daytona sandbox returns a non-zero (or null) exit code. This helper wraps sandbox.process.executeCommand for labeled operations (e.g. syncOut tar creation, confinement prechecks) and aborts on the first failure with the exit code and trimmed stdout detail.

Source

Thrown at packages/plugins/sandbox-providers/daytona/src/file-sync.ts:273

      } else {
        total += 1;
      }
    }
  };
  await walk(root).catch(() => undefined);
  return total;
}

async function assertSandboxCommandOk(
  sandbox: Sandbox,
  command: string,
  timeoutSeconds: number,
  label: string,
): Promise<void> {
  const result = await sandbox.process.executeCommand(command, undefined, undefined, timeoutSeconds);
  if ((result.exitCode ?? 1) !== 0) {
    const detail = (result.result ?? result.artifacts?.stdout ?? "").toString().trim();
    throw new Error(`Daytona ${label} command failed (exit ${result.exitCode ?? "unknown"})${detail ? `: ${detail}` : ""}`);
  }
}

/**
 * POSIX-sh preamble defining a `_pc_resolve` canonicalizer (prefer `realpath`,
 * fall back to `readlink -f`; fail closed with exit 40 if neither exists so the
 * host-side lexical check is never the only line of defense) and `_pc_root` =
 * the resolved workspace remote dir. Shared by every sandbox-side symlink-escape
 * guard. The caller wraps the assembled script in `sh -c` so it runs under a
 * POSIX shell regardless of the sandbox's default login shell.
 */
function canonicalizerPreamble(quotedRoot: string): string[] {
  return [
    'if command -v realpath >/dev/null 2>&1; then _pc_resolve() { realpath -- "$1"; };',
    'elif command -v readlink >/dev/null 2>&1; then _pc_resolve() { readlink -f -- "$1"; };',
    'else echo "no path canonicalizer available"; exit 40; fi;',
    `_pc_root=$(_pc_resolve ${quotedRoot}) || { echo "cannot resolve root"; exit 41; };`,
  ];

View on GitHub (pinned to 67001ec6eb)

Solutions

1. Read the exit code and detail in the error message — exit 40 means no realpath/readlink, exit 41 means the root dir cannot be resolved.
2. Ensure the sandbox image includes tar, realpath (or readlink), and standard POSIX coreutils.
3. Verify the workspace remote dir exists and is writable before sync.
4. Retry on transient infrastructure failures; if persistent, recreate the sandbox lease.

Example fix

// before: image omits coreutils → exit 40
// after: include realpath/readlink in the image
RUN apt-get update && apt-get install -y coreutils

try {
  await assertSandboxCommandOk(sandbox, cmd, timeoutSeconds, 'syncOut tar');
} catch (e) {
  const msg = e instanceof Error ? e.message : '';
  if (msg.includes('exit 40')) { /* no realpath/readlink — fix image */ }
  else if (msg.includes('exit 41')) { /* root unresolvable — verify remoteCwd */ }
  throw e;
}

When it happens

Trigger: Any sandbox-side command run via assertSandboxCommandOk exits non-zero: tar creation failing, a confinement precheck returning exit 40/41 (no canonicalizer / unresolvable root), missing utilities (tar/realpath/readlink), or sandbox disk/memory exhaustion.

Common situations: The sandbox image lacks required POSIX utilities (tar, realpath, readlink); the workspace remote dir is missing or unreadable; disk full during tar; the sandbox shell is non-POSIX and the sh -c wrapper still fails; transient sandbox infrastructure errors.

Related errors

• Daytona sync ${label} path is not a confined absolute path:
• Daytona sync ${label} path escapes the workspace remote dir:
• Daytona syncOut refusing tarball with an unparseable entry l
• Daytona syncOut refusing unparseable symlink entry: ${line}
• Daytona syncOut refusing unparseable hardlink entry: ${line}

AI-assisted analysis of paperclipai/paperclip@67001ec6eb (2026-08-12). Data as JSON: /api/errors/b00b2156ce4bc3f2. Report an issue: GitHub.