langchain-ai/deepagentsjs
1
0
Fork 0
mirror of https://github.com/langchain-ai/deepagentsjs.git synced 2026-07-19 08:26:01 -04:00
Code Issues 42 Packages Projects Releases 10 Wiki Activity

[PR #565] [CLOSED] fix(node-vfs): safely rewrite absolute execute paths #565

New Issue
Closed
opened 2026-06-05 17:23:46 -04:00 by yindo · 0 comments
yindo commented 2026-06-05 17:23:46 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/deepagentsjs/pull/565
Author: @hntrl
Created: 6/1/2026
Status: ❌ Closed

Base: main ← Head: hunter/fix-node-vfs-absolute-exec-paths

📝 Commits (5)

  • 8750cbd fix(node-vfs): safely rewrite absolute execute paths
  • 8b50b17 fix(node-vfs): harden execute path rewriting
  • a30f9d4 refactor(node-vfs): simplify heredoc-safe path rewriting
  • 19409f5 refactor(node-vfs): remove heredoc-specific rewrite logic
  • 86fdb22 fix(node-vfs): reduce host leakage in execute

📊 Changes

4 files changed (+162 additions, -14 deletions)

View changed files

➕ .changeset/vfs-absolute-exec-paths.md (+9 -0)
➕ libs/providers/node-vfs/src/const.ts (+11 -0)
📝 libs/providers/node-vfs/src/sandbox.int.test.ts (+106 -0)
📝 libs/providers/node-vfs/src/sandbox.ts (+36 -14)

📄 Description

Summary

Fixes #259.

This change fixes @langchain/node-vfs command execution behavior for absolute paths in execute(). The previous implementation only rewrote absolute paths when the top-level path already existed in the VFS root, which caused commands like cp /a.txt /b.txt and redirections to /b.txt to target host root paths and fail with read-only filesystem errors.

The rewrite behavior is now sandbox-first for workspace paths, while still preserving host system absolute paths for known roots unless those roots are intentionally shadowed by VFS content.

Changes

@langchain/node-vfs

  • Refactored absolute path rewriting in VfsSandbox#rewriteVfsPaths to:
    • Rewrite absolute paths whose root exists in VFS.
    • Rewrite unknown absolute roots to the temp execution workspace.
    • Preserve known host system roots through an explicit allowlist unless shadowed by VFS.
  • Moved host absolute root allowlist into src/const.ts and imported it from sandbox.ts.
  • Added integration tests for:
    • cp /a.txt /b.txt destination rewriting.
    • Absolute redirection targets with an empty workspace.
    • Host absolute path passthrough (test -x /bin/sh).
    • VFS precedence when allowlisted roots are shadowed (for example /tmp/...).

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/deepagentsjs/pull/565 **Author:** [@hntrl](https://github.com/hntrl) **Created:** 6/1/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `hunter/fix-node-vfs-absolute-exec-paths` --- ### 📝 Commits (5) - [`8750cbd`](https://github.com/langchain-ai/deepagentsjs/commit/8750cbd4dfb7548dff9d5392d6f3afa45be8b63c) fix(node-vfs): safely rewrite absolute execute paths - [`8b50b17`](https://github.com/langchain-ai/deepagentsjs/commit/8b50b176c9c3ce58a281f572daef0bbcc01f7105) fix(node-vfs): harden execute path rewriting - [`a30f9d4`](https://github.com/langchain-ai/deepagentsjs/commit/a30f9d47f0dc171e66dfa05616788c3d12a4a89f) refactor(node-vfs): simplify heredoc-safe path rewriting - [`19409f5`](https://github.com/langchain-ai/deepagentsjs/commit/19409f569371340ef58cb9f93489bd0ea8b34ab1) refactor(node-vfs): remove heredoc-specific rewrite logic - [`86fdb22`](https://github.com/langchain-ai/deepagentsjs/commit/86fdb2213ae59624bcb6d599d310c0c2da87a9ef) fix(node-vfs): reduce host leakage in execute ### 📊 Changes **4 files changed** (+162 additions, -14 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/vfs-absolute-exec-paths.md` (+9 -0) ➕ `libs/providers/node-vfs/src/const.ts` (+11 -0) 📝 `libs/providers/node-vfs/src/sandbox.int.test.ts` (+106 -0) 📝 `libs/providers/node-vfs/src/sandbox.ts` (+36 -14) </details> ### 📄 Description ## Summary Fixes #259. This change fixes `@langchain/node-vfs` command execution behavior for absolute paths in `execute()`. The previous implementation only rewrote absolute paths when the top-level path already existed in the VFS root, which caused commands like `cp /a.txt /b.txt` and redirections to `/b.txt` to target host root paths and fail with read-only filesystem errors. The rewrite behavior is now sandbox-first for workspace paths, while still preserving host system absolute paths for known roots unless those roots are intentionally shadowed by VFS content. ## Changes ### `@langchain/node-vfs` - Refactored absolute path rewriting in `VfsSandbox#rewriteVfsPaths` to: - Rewrite absolute paths whose root exists in VFS. - Rewrite unknown absolute roots to the temp execution workspace. - Preserve known host system roots through an explicit allowlist unless shadowed by VFS. - Moved host absolute root allowlist into `src/const.ts` and imported it from `sandbox.ts`. - Added integration tests for: - `cp /a.txt /b.txt` destination rewriting. - Absolute redirection targets with an empty workspace. - Host absolute path passthrough (`test -x /bin/sh`). - VFS precedence when allowlisted roots are shadowed (for example `/tmp/...`). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-05 17:23:46 -04:00
yindo closed this issue 2026-06-05 17:23:46 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
help wanted
needs-response
pull-request
Mirrored from GitHub Pull Request
 stale
triage: high-impact
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/deepagentsjs#565
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?