Reject colliding PythonInterpreter file mounts

dspy/primitives/python_interpreter.py

@@ -267,6 +267,14 @@ def __init__(
 
         self.enable_read_paths = enable_read_paths or []
         self.enable_write_paths = enable_write_paths or []
+        mounts = {}
+        for path in [*self.enable_read_paths, *self.enable_write_paths]:
+            if path:
+                virtual_path = os.path.basename(os.fspath(path))
+                host_path = _canonicalize_path(path)
+                if virtual_path in mounts and mounts[virtual_path] != host_path:
+                    raise CodeInterpreterError("Mounted files must have unique basenames inside the sandbox.")
+                mounts[virtual_path] = host_path
         self.enable_env_vars = enable_env_vars or []
         self.enable_network_access = enable_network_access or []
         self.sync_files = sync_files

tests/primitives/test_python_interpreter.py

@@ -413,6 +413,34 @@ def test_custom_deno_command_is_unchanged():
     assert interpreter.deno_command is not command
 
 
+def test_rejects_mounts_with_the_same_guest_basename(tmp_path):
+    first = tmp_path / "first" / "shared.txt"
+    second = tmp_path / "second" / "shared.txt"
+    first.parent.mkdir()
+    second.parent.mkdir()
+
+    with pytest.raises(CodeInterpreterError, match="unique basenames"):
+        PythonInterpreter(deno_command=["deno"], enable_read_paths=[first], enable_write_paths=[second])
+
+
+def test_allows_same_canonical_file_as_read_and_write_mount(tmp_path):
+    path = tmp_path / "shared.txt"
+
+    PythonInterpreter(deno_command=["deno"], enable_read_paths=[path], enable_write_paths=[path])
+
+
+def test_rejects_alias_basename_colliding_with_another_file(tmp_path):
+    first = tmp_path / "first.txt"
+    second = tmp_path / "second" / "shared.txt"
+    alias = tmp_path / "alias" / "shared.txt"
+    second.parent.mkdir()
+    alias.parent.mkdir()
+    alias.symlink_to(first)
+
+    with pytest.raises(CodeInterpreterError, match="unique basenames"):
+        PythonInterpreter(deno_command=["deno"], enable_read_paths=[first, alias, second])
+
+
 def test_custom_deno_command_preserves_environment(monkeypatch):
     monkeypatch.setenv("DENO_NO_PACKAGE_JSON", "0")
     captured = {}