Greptile Summary

Fixed mkdirp boundary validation to handle pre-existing directories by adding a fallback when openBoundaryFile returns non-path failures.

How it works:

• When allowedType === "directory" and boundary open fails with a non-path error (validation/io), the code now falls back to checking if the target is an existing directory on the host
• If it is a directory, the operation continues; otherwise the original error is thrown
• Canonical mount and writability checks still execute after the fallback, maintaining security

Key changes:

• Added directory-specific fallback in assertPathSafety (lines 270-294) that uses fs.statSync to verify existing directories
• Preserves strict boundary checking for files while avoiding false negatives for directory operations

The fix correctly addresses the issue where mkdirp failed on existing in-boundary directories due to openVerifiedFileSync being optimized for file operations. Tests verify the fix works for existing subdirectories while still rejecting files.

Confidence Score: 4/5

• This PR is safe to merge with minimal risk - it fixes a real bug while maintaining security boundaries
• The fix correctly addresses the mkdirp issue for existing directories while preserving security checks (lexical and canonical boundary validation still execute). Tests verify the behavior. One minor style issue with error handling logic could be clearer but doesn't affect correctness.
• No files require special attention - the changes are focused and well-tested

_{Last reviewed commit: 0e455d9}

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

1. 🔵 Sandbox boundary validation bypass via directory stat() fallback in assertPathSafety

Description

SandboxFsBridgeImpl.assertPathSafety uses openBoundaryFile(...) as a boundary/alias guard before executing filesystem-affecting commands inside the sandbox container.

A new fallback treats certain openBoundaryFile failures as non-fatal when allowedType === "directory" by checking only fs.statSync(hostPath).isDirectory().

Problem:

• The fallback triggers for any openBoundaryFile failure whose reason !== "path" (i.e., it includes "validation" failures, not just IO failures).
• "validation" failures can represent security-relevant boundary rejections (e.g., path not within the mount root, or alias/symlink canonicalization escaping the boundary).
• fs.statSync() does not enforce the boundary root constraint and follows symlinks.

As a result, an attacker can potentially bypass boundary validation for directory operations (currently mkdirp) whenever hostPath happens to be an existing directory, even if openBoundaryFile rejected it.

Vulnerable code (introduced in this diff):

if (!guarded.ok) {
  if (guarded.reason !== "path") {
    const canFallbackToDirectoryStat =
      options.allowedType === "directory" && this.pathIsExistingDirectory(target.hostPath);
    if (!canFallbackToDirectoryStat) {
      throw guarded.error instanceof Error
        ? guarded.error
        : new Error(
            `Sandbox boundary checks failed; cannot ${options.action}: ${target.containerPath}`,
          );
    }
  }
}

Security impact:

• inputs: filePath provided to mkdirp()
• guard bypass: openBoundaryFile failure with reason: "validation" becomes non-fatal if statSync() says directory
• sink: runCommand('... mkdir -p -- "$1"') executes after the weakened check

This broad fallback should be limited to the specific platform-IO case it was meant to address; otherwise it undermines boundary enforcement for directories.

Recommendation

Limit the fallback to the intended IO-only directory-open incompatibility case, and (optionally) to mkdirp explicitly.

Suggested change:

if (!guarded.ok) {
  if (guarded.reason === "io" && options.action === "create directories" && options.allowedType === "directory") {
    if (!this.pathIsExistingDirectory(target.hostPath)) {
      throw guarded.error instanceof Error ? guarded.error : new Error(...);
    }
  } else if (guarded.reason !== "path") {
    throw guarded.error instanceof Error ? guarded.error : new Error(...);
  }
}

This preserves support for platforms that cannot openSync() directories while ensuring that boundary validation failures are never bypassed.

Analyzed PR: #31547 at commit 061121f

_{Last updated on: 2026-03-02T17:10:30Z}

Landed via temp rebase onto main.

• Gate: pnpm test src/agents/sandbox/fs-bridge.test.ts (full gate blocked by pre-existing main failure in extensions/zalouser/src/monitor.ts:141)
• Land commit: 061121f
• Merge commit: 44270c5

Thanks @stakeswky!