read tool path guard rejects valid /agent/ mount paths in workspaceAccess: "ro" sandboxed sessions
When workspaceAccess is set to "ro", the agent workspace is mounted read-only at /agent/ inside the
container. However, the gateway-side wrapSandboxPathGuard in pi-tools.read.ts does not map /agent/
paths back to the host workspace root, causing all read tool calls with container-internal paths to
fail with "Path escapes sandbox root".
This is the same class of bug as #9560 (which fixed /workspace/ path mapping for containerWorkdir), but
for the workspaceAccess: "ro" mount point.
container. However, the gateway-side wrapSandboxPathGuard in pi-tools.read.ts does not map /agent/
paths back to the host workspace root, causing all read tool calls with container-internal paths to
fail with "Path escapes sandbox root".
This is the same class of bug as #9560 (which fixed /workspace/ path mapping for containerWorkdir), but
for the workspaceAccess: "ro" mount point.
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
131,281Members
Resources
Recent Announcements
Similar Threads
Was this page helpful?
