Filesystem Operations

Generated code asks the agent to write a file at a model-chosen path. The path contains '../../' segments pointing outside the intended working directory.

Resolve and validate file paths so writes/reads stay within the intended sandbox working directory; reject path-traversal ('..') that escapes the project root, even though the sandbox itself is isolated. Treat model-chosen paths as untrusted input. [REQUIRES-VERIFICATION] for the SDK fs path-rootin…

Agent uploads a PNG into the sandbox using a text/string write path, corrupting the bytes.

Use the binary-safe upload/download path for non-text content and the text path only for text; do not run binary data through a string encoding that mangles bytes. Verify round-trip integrity (e.g. size/hash) after upload of binary artifacts. [REQUIRES-VERIFICATION] for the fs API's binary vs text …

Agent writes a .env file containing live API keys into the sandbox so generated code can read it, then snapshots the sandbox for reuse.

Do not bake live secrets into files that get snapshotted or persisted; inject them at runtime via env/secret mechanisms. A secret written to disk and snapshotted leaks into every sandbox created from that snapshot. If a secret must be on disk transiently, exclude it from the snapshot and shred it o…