langchain-ai/deepagentsjs
1
0
Fork 0
mirror of https://github.com/langchain-ai/deepagentsjs.git synced 2026-07-18 16:04:44 -04:00
Code Issues 42 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #259] VfsSandbox: execute tool doesn't respect sandbox working directory on macOS #238

New Issue
Closed
opened 2026-06-05 17:21:12 -04:00 by yindo · 3 comments
yindo commented 2026-06-05 17:21:12 -04:00
Owner
Copy Link
Copy Source

Originally created by @enteve on GitHub (Feb 28, 2026).
Original GitHub issue: https://github.com/langchain-ai/deepagentsjs/issues/259

Summary

The execute tool runs commands in the host's root directory instead of the sandbox directory, causing file system operations to fail with "Read-only file system" errors on macOS.

Steps to Reproduce

  1. Create a VfsSandbox with some initial files
  2. Ask the agent to copy a file from path A to path B using execute tool (e.g., cp /a.txt /b.txt)
  3. The agent will try to execute the command in the host's root directory instead of the sandbox directory

Expected Behavior

The command should execute within the sandbox directory, operating on files in the virtual file system.

Actual Behavior

Error: Read-only file system

The command executes in the host's root directory (/) instead of the sandbox working directory, which is read-only.

Related Issues

https://github.com/langchain-ai/deepagentsjs/issues/203

The fix for #203 addressed ls, read_file, and write_file tools, which now work correctly. However, the execute tool still has the same issue and was not fixed.

Environment

  • @langchain/node-vfs: latest
  • deepagents: "^1.8.0"
  • OS: macOS (Darwin 24.5.0)
Originally created by @enteve on GitHub (Feb 28, 2026). Original GitHub issue: https://github.com/langchain-ai/deepagentsjs/issues/259 ## Summary The `execute` tool runs commands in the host's root directory instead of the sandbox directory, causing file system operations to fail with "Read-only file system" errors on macOS. ## Steps to Reproduce 1. Create a VfsSandbox with some initial files 2. Ask the agent to copy a file from path A to path B using `execute` tool (e.g., `cp /a.txt /b.txt`) 3. The agent will try to execute the command in the host's root directory instead of the sandbox directory ## Expected Behavior The command should execute within the sandbox directory, operating on files in the virtual file system. ## Actual Behavior Error: Read-only file system The command executes in the host's root directory (`/`) instead of the sandbox working directory, which is read-only. ## Related Issues https://github.com/langchain-ai/deepagentsjs/issues/203 The fix for #203 addressed `ls`, `read_file`, and `write_file` tools, which now work correctly. However, the `execute` tool still has the same issue and was not fixed. ## Environment - `@langchain/node-vfs`: latest - `deepagents`: "^1.8.0" - OS: macOS (Darwin 24.5.0)
yindo closed this issue 2026-06-05 17:21:12 -04:00
yindo commented 2026-06-05 17:21:13 -04:00
Author
Owner
Copy Link
Copy Source

@JadenKim-dev commented on GitHub (Mar 6, 2026):

I ran into a recurring issue with LocalShellBackend in virtualMode: true when using a custom shell tool backed by an LLM.
The LLM consistently generated absolute paths relative to the sandbox root (e.g. cp /a.txt /b.txt), but execute() resolved those paths against the real host filesystem instead of the virtual root — bypassing the path mapping entirely. This caused the command to fail repeatedly.

Since shell command strings can't be reliably parsed and rewritten, I wonder if adjusting the execute tool's prompt to encourage relative paths.

<!-- gh-comment-id:4015581933 --> @JadenKim-dev commented on GitHub (Mar 6, 2026): I ran into a recurring issue with `LocalShellBackend` in `virtualMode: true` when using a custom shell tool backed by an LLM. The LLM consistently generated absolute paths relative to the sandbox root (e.g. `cp /a.txt /b.txt`), but `execute()` resolved those paths against the real host filesystem instead of the virtual root — bypassing the path mapping entirely. This caused the command to fail repeatedly. Since shell command strings can't be reliably parsed and rewritten, I wonder if adjusting the `execute` tool's prompt to encourage relative paths.
yindo commented 2026-06-05 17:21:13 -04:00
Author
Owner
Copy Link
Copy Source

@hnustwjj commented on GitHub (Mar 17, 2026):

same problem when using execute tool with absolute path

<!-- gh-comment-id:4079281540 --> @hnustwjj commented on GitHub (Mar 17, 2026): same problem when using execute tool with absolute path
yindo commented 2026-06-05 17:21:13 -04:00
Author
Owner
Copy Link
Copy Source

@hntrl commented on GitHub (Jun 2, 2026):

Addressing this in #575. Basically we think that pulling vfs and making that a deepagents sandbox was an over-correction on our part -- Vfs doesn't have any sandboxing guarantees and we have a not-great way of instrumenting the execute command by pulling it into a temporary path

Our guidance going forward will be to use VfsBackend (which just exposes an interface that the agent can consume) rather than VfsSandbox which has more direct execute access

<!-- gh-comment-id:4605445970 --> @hntrl commented on GitHub (Jun 2, 2026): Addressing this in #575. Basically we think that pulling vfs and making that a deepagents sandbox was an over-correction on our part -- Vfs doesn't have any sandboxing guarantees and we have a not-great way of instrumenting the `execute` command by pulling it into a temporary path Our guidance going forward will be to use `VfsBackend` (which just exposes an interface that the agent can consume) rather than `VfsSandbox` which has more direct execute access
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
help wanted
needs-response
pull-request
Mirrored from GitHub Pull Request
 stale
triage: high-impact
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/deepagentsjs#238
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?