fix: root a glob in the workspace, not in the machine - #106
Merged
Conversation
`glob_command` passed its root through to `find`, and a caller naming the
backend's root spells it `/`, `""` or `.`. For a backend addressing files
by virtual path, `/` *is* the top of the namespace; for a shell it is the
machine. So `find /` searched the whole container.
Measured against a running `sandboxd`, in a session holding three files:
pattern entries outside the workspace
* 2540 2540
**/* 2540 2540
*.txt 25 22
./**/* 0 -
Two things follow, and neither announces itself. An agent's own `glob`
tool reads the image it is running on - `/proc`, `/usr`, every path in the
base layer - into its context, and answers a question about the workspace
with 2540 paths that are not in it. And any caller diffing two globs to
learn what changed during a turn is comparing two photographs of `/proc`:
one such caller posts an agent's new files back into a chat channel.
The root now resolves to `.`, which is the session's working directory,
and an absolute path is still passed through - `/etc` is a root a caller
may mean and this is not the place to argue with them.
`**/*` is fixed with it, and it is the pattern that matters most: `find
-path` matches with fnmatch, where `**` is no different from `*` and every
`/` in the pattern must be present in the path, so `**/*` required two
slashes and missed every file at the top level. A leading `**/` means "at
any depth", which is exactly what the `*/` prefix already provides, so it
is dropped rather than stacked.
Verified on the same service after the change:
pwd -> /workspace
find . -path '*/*' -type f -> ./b.txt ./deep/deeper/c.txt ./uploads/a.txt
Six new tests - the three spellings of the root, an absolute root left
alone, and four patterns through the globstar rule. 1670 tests, 100%
coverage.
Merged
DEENUU1
added a commit
that referenced
this pull request
Aug 20, 2026
Cuts 0.2.27 for #106 - a glob rooted in the workspace rather than in the machine. Behaviour change, and worth reading before upgrading: a caller that relied on `glob` searching the whole filesystem from a shell-backed sandbox will now search the working directory. That reliance is unlikely to have been deliberate - the same call on a virtual-path backend always meant the workspace - but a caller wanting the machine can still ask for it by naming an absolute root. Everything else is a fix in the direction callers already expected: `**/*` now matches files at the top level, and a glob of `*` no longer answers 2540 paths from `/proc`. Version and changelog only. Verified on #106 before merge: the full suite, 100% coverage, and the built command checked against a live service - `find . -path '*/*' -type f` in a workspace holding three files answers exactly those three.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
glob_commandpassed its root through tofind, and a caller naming thebackend's root spells it
/,""or.. For a backend addressing filesby virtual path,
/is the top of the namespace; for a shell it is themachine. So
find /searched the whole container.Measured against a running
sandboxd, in a session holding three files:Two things follow, and neither announces itself. An agent's own
globtool reads the image it is running on -
/proc,/usr, every path in thebase layer - into its context, and answers a question about the workspace
with 2540 paths that are not in it. And any caller diffing two globs to
learn what changed during a turn is comparing two photographs of
/proc:one such caller posts an agent's new files back into a chat channel.
The root now resolves to
., which is the session's working directory,and an absolute path is still passed through -
/etcis a root a callermay mean and this is not the place to argue with them.
**/*is fixed with it, and it is the pattern that matters most:find -pathmatches with fnmatch, where**is no different from*and every/in the pattern must be present in the path, so**/*required twoslashes and missed every file at the top level. A leading
**/means "atany depth", which is exactly what the
*/prefix already provides, so itis dropped rather than stacked.
Verified on the same service after the change:
Six new tests - the three spellings of the root, an absolute root left
alone, and four patterns through the globstar rule. 1670 tests, 100%
coverage.
Found while tracking down why an agent's
lsreported an empty workspace in a downstream product (vstorm-co/agenticos#1039). The attachment bug there was its own, but this one is why the same product's channel snapshots and the agent'sglobtool were both reading the container's base image.