Inaccurate instances of "This operation accesses path(s) outside allowed directories"

Describe the bug

Twice this morning I've been asked to approve actions with this message:

This operation accesses path(s) outside allowed directories...

But the action in question is not actually accessing other paths; in one instance there was a substring like /xyz as part of an awk command being run and it seems to be interpreted as the directory, /xyz.

In the second instance, I don't understand why it happened at all. A markdown file in the current directory was being created and I was asked to approve access outside allowed directories.

Affected version

0.0.330

Steps to reproduce the behavior

Both times this occurred was in the middle of the agent trying to debug an issue and I cannot reliably reproduce this.

Expected behavior

No response

Additional context

macOS
ARM
iterm2
zsh

Hi! We improved our path detection heuristic in 0.0.332, give it a shot!

This just happened again on 0.0.332

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
 │ This operation accesses path(s) outside allowed directories:/tmp/xyz.md, /dirA/fileX.html, /dirB/fileY.html, /dirA/fileZ.html  .                                                                                   │
 │                                                                                                                      │
 │ Would you like to add these directories to the allowed list?                                                         │
 │                                                                                                                      │
 │ ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
 │ │ /tmp/xyz.md, /dirA/fileX.html, /dirB/fileY.html, /dirA/fileZ.html                              │ │
 │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
 │                                                                                                                      │
 │ ❯ 1. Yes                                                                                                             │
 │   2. No (Esc)                                                                                                        │
 │                                                                                                                      │
 │ Confirm with number keys or ↑↓ keys and Enter, Cancel with Esc

the actual command it wanted to run was:

cat << 'EOF' > /tmp/xyz.md 
... (markdown contents contains the substrings '/dirA/fileX.html', '/dirB/fileY.html', and '/dirA/fileZ.html') ...
EOF
cat /tmp/xyz.md

And to be clear, I think the mention of /tmp is accurate here. I am referring to the mentions of the other directories which are only mentioned due to their presence as substrings in the document.

Another example:

This operation accesses path(s) outside allowed directories: //.                                                  │
 │                                                                                                                   │
 │ Would you like to add these directories to the allowed list?                                                      │
 │                                                                                                                   │
 │ ╭───────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
 │ │ //                                                                                                            │ │
 │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
 │                                                                                                                   │
 │ ❯ 1. Yes                                                                                                          │
 │   2. No (Esc)                                                                                                     │
 │                                                                                                                   │
 │ Confirm with number keys or ↑↓ keys and Enter, Cancel with Esc

and this was again in response to trying to write some markdown that contained comments (//)

another example

╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
 │ This operation accesses path(s) outside allowed directories: /^ir:/,/^sentinels:/{print NR": "$0}.                               │
 │                                                                                                                                  │
 │ Would you like to add these directories to the allowed list?                                                                     │
 │                                                                                                                                  │
 │ ╭──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
 │ │ /^ir:/,/^sentinels:/{print NR": "$0}                                                                                         │ │
 │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
 │                                                                                                                                  │
 │ ❯ 1. Yes                                                                                                                         │
 │   2. No (Esc)                                                                                                                    │
 │                                                                                                                                  │
 │ Confirm with number keys or ↑↓ keys and Enter, Cancel with Esc                                                                   │
 ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

and this was from wanting to run this command:

awk '/^ir:/,/^sentinels:/{print NR": "$0}' xyz.yml | head -220

Another example I ran into is the following where it appears a heredoc cat command made me believe it was adding the root directory to the allowed list:

I ran into the heredoc cat issue over the weekend -- definitely more work we need to do on our path checking heuristic!

I've run into this quite a few times in the past couple of days. Just now I saw this:

○ Get table names in order
   $ cd /Users/jason/Work/projects/SomeApi && awk '/CreateTable/,/name:/'
   Services/Migrations/20251001031252_InitialCreate.cs | grep 'name: "' | cut -d'"' -f2 | nl
   ↪ 1 line...

 ╭───────────────────────────────────────────────────────────────────────────────────────────╮
 │ This operation accesses path(s) outside allowed directories: /CreateTable/,/name:/.       │
 │                                                                                           │
 │ Would you like to add these directories to the allowed list?                              │
 │                                                                                           │
 │ ╭───────────────────────────────────────────────────────────────────────────────────────╮ │
 │ │ /CreateTable/,/name:/                                                                 │ │
 │ ╰───────────────────────────────────────────────────────────────────────────────────────╯ │
 │                                                                                           │
 │ ❯ 1. Yes                                                                                  │
 │   2. No (Esc)                                                                             │
 │                                                                                           │
 │ Confirm with number keys or ↑↓ keys and Enter, Cancel with Esc                            │
 ╰───────────────────────────────────────────────────────────────────────────────────────────╯

This completely breaks the point of agentic when we have to sit and watch it run in case some random string is going to be flagged as a folder and stop execution.

It's not like it's now and then, it happens every single prompt.

Several rounds of improvements to the path detection heuristic have landed since this was filed, starting with v0.0.332 and continuing through recent releases. The specific scenarios reported here -- awk regex patterns being misidentified as paths, heredoc content triggering false positives, and // comments in markdown -- have been addressed. Some edge cases in the broader category of path detection false positives are still tracked separately. If you're still hitting the specific issues described here on a current version, please feel free to reopen.

Navigation Menu

Repository navigation

Inaccurate instances of "This operation accesses path(s) outside allowed directories" #159

Describe the bug

Affected version

Steps to reproduce the behavior

Expected behavior

Additional context

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Inaccurate instances of "This operation accesses path(s) outside allowed directories" #159

Description

Describe the bug

Affected version

Steps to reproduce the behavior

Expected behavior

Additional context

Activity

RyanHecht commented on Oct 1, 2025

andrewneilson commented on Oct 2, 2025

andrewneilson commented on Oct 2, 2025

andrewneilson commented on Oct 2, 2025

andyfeller commented on Oct 3, 2025

RyanHecht commented on Oct 6, 2025

jason0x43 commented on Oct 8, 2025

dogmatic69 commented on Jan 22, 2026

examon commented on Apr 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions