Inaccurate instances of "This operation accesses path(s) outside allowed directories"

[andrewneilson]

Describe the bug

Twice this morning I've been asked to approve actions with this message:

This operation accesses path(s) outside allowed directories...

But the action in question is not actually accessing other paths; in one instance there was a substring like /xyz as part of an awk command being run and it seems to be interpreted as the directory, /xyz.

In the second instance, I don't understand why it happened at all. A markdown file in the current directory was being created and I was asked to approve access outside allowed directories.

Affected version

0.0.330

Steps to reproduce the behavior

Both times this occurred was in the middle of the agent trying to debug an issue and I cannot reliably reproduce this.

Expected behavior

No response

Additional context

• macOS
• ARM
• iterm2
• zsh

[RyanHecht]

Hi! We improved our path detection heuristic in 0.0.332, give it a shot!

[andrewneilson]

This just happened again on 0.0.332

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
 │ This operation accesses path(s) outside allowed directories:/tmp/xyz.md, /dirA/fileX.html, /dirB/fileY.html, /dirA/fileZ.html  .                                                                                   │
 │                                                                                                                      │
 │ Would you like to add these directories to the allowed list?                                                         │
 │                                                                                                                      │
 │ ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
 │ │ /tmp/xyz.md, /dirA/fileX.html, /dirB/fileY.html, /dirA/fileZ.html                              │ │
 │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
 │                                                                                                                      │
 │ ❯ 1. Yes                                                                                                             │
 │   2. No (Esc)                                                                                                        │
 │                                                                                                                      │
 │ Confirm with number keys or ↑↓ keys and Enter, Cancel with Esc         

the actual command it wanted to run was:

cat << 'EOF' > /tmp/xyz.md 
... (markdown contents contains the substrings '/dirA/fileX.html', '/dirB/fileY.html', and '/dirA/fileZ.html') ...
EOF
cat /tmp/xyz.md

And to be clear, I think the mention of /tmp is accurate here. I am referring to the mentions of the other directories which are only mentioned due to their presence as substrings in the document.

[andrewneilson]

Another example:

This operation accesses path(s) outside allowed directories: //.                                                  │
 │                                                                                                                   │
 │ Would you like to add these directories to the allowed list?                                                      │
 │                                                                                                                   │
 │ ╭───────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
 │ │ //                                                                                                            │ │
 │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
 │                                                                                                                   │
 │ ❯ 1. Yes                                                                                                          │
 │   2. No (Esc)                                                                                                     │
 │                                                                                                                   │
 │ Confirm with number keys or ↑↓ keys and Enter, Cancel with Esc     

and this was again in response to trying to write some markdown that contained comments (//)

[andrewneilson]

another example

╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
 │ This operation accesses path(s) outside allowed directories: /^ir:/,/^sentinels:/{print NR": "$0}.                               │
 │                                                                                                                                  │
 │ Would you like to add these directories to the allowed list?                                                                     │
 │                                                                                                                                  │
 │ ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
 │ │ /^ir:/,/^sentinels:/{print NR": "$0}                                                                                         │ │
 │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
 │                                                                                                                                  │
 │ ❯ 1. Yes                                                                                                                         │
 │   2. No (Esc)                                                                                                                    │
 │                                                                                                                                  │
 │ Confirm with number keys or ↑↓ keys and Enter, Cancel with Esc                                                                   │
 ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

and this was from wanting to run this command:

awk '/^ir:/,/^sentinels:/{print NR": "$0}' xyz.yml | head -220

[andyfeller]

Another example I ran into is the following where it appears a heredoc cat command made me believe it was adding the root directory to the allowed list:

[RyanHecht]

I ran into the heredoc cat issue over the weekend -- definitely more work we need to do on our path checking heuristic!