zed-industries/zed · error · anyhow::Error

failed to provide writable sandbox path {}: it no longer exi

Error message

failed to provide writable sandbox path {}: it no longer exists

What it means

wrap_invocation validates writable bind paths before running bwrap; a captured writable path no longer exists on disk (it was removed after the sandbox policy captured it), and bwrap cannot bind a nonexistent source, so sandbox setup fails rather than recreating the path with ambient permissions.

Source

Thrown at crates/sandbox/src/linux_bubblewrap.rs:625

            "too many writable binds to validate ({} > {MAX_VALIDATED_BINDS})",
            writable_dirs.len()
        );
    }

    // Every writable path must already exist: `bwrap` can't bind a nonexistent
    // source, and the command can't create it either (its parent is read-only
    // inside the sandbox). Callers hand us captured canonical paths whose
    // inodes were pinned at policy-construction time, so a missing path here
    // means the location vanished since capture. Never create it with the
    // agent's ambient permissions — recreating from path text would bind a
    // fresh, unapproved object in place of the pinned one (and historically
    // this materialized bogus paths, e.g. a granted *file* path springing into
    // existence as a directory). Running anyway would give the command silently
    // less access than it believes it has — so fail closed with a clear error.
    if !permissions.allow_fs_write {
        for directory in writable_dirs {
            if !directory.exists() {
                bail!(
                    "failed to provide writable sandbox path {}: it no longer exists",
                    directory.display()
                );
            }
        }
    }

    let bwrap = resolve_bwrap().map_err(|status| anyhow!(status.describe()))?;
    let proxy_socket_sandbox_path = match permissions.network {
        NetworkAccess::LocalhostPort(_) => Some(unique_proxy_socket_sandbox_path()),
        NetworkAccess::None | NetworkAccess::All => None,
    };
    let mut bwrap_args = build_bwrap_args_with_sandbox_paths(
        writable_dirs,
        protected_paths,
        permissions,
        cwd,
        proxy_socket_path,

View on GitHub (pinned to 5a9b9558db)

Solutions

1. Re-run the task so sandbox policy re-captures current paths
2. Identify what deleted the directory (build clean, tmp reaping) and exclude it from writable paths
3. Report the bug if the path should have persisted

When it happens

Trigger: Thrown at crates/sandbox/src/linux_bubblewrap.rs:625 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zed-industries/zed@5a9b9558db (2026-08-20). Data as JSON: /api/errors/ca596f704152d8c5. Report an issue: GitHub.