[BUG] Fail to call tool, reporting fake security problem: "Command blocked by safety guard"

[MaoJianwei]

workspace is /root/.picoclaw/workspace

{"role":"assistant","content":"","tool_calls":[{"id":"chatcmpl-tool-ae19376ae89cb502","type":"function","function":{"name":"exec","arguments":"{\"action\":\"run\",\"command\":\"python3 /root/.picoclaw/workspace/skills/a/scripts/a.py 165 \\\"aaa\\\"\"}"}}]}
{"role":"tool","content":"Command blocked by safety guard (path outside working dir)","tool_call_id":"chatcmpl-tool-ae19376ae89cb502"}

[SiYue-ZO]

I suspect this issue might be related to root privileges and how the Safety Guard validates the path.

Permission Constraints: Since the script is located under /root/, the execution environment might require sudo privileges to access the file, which could be triggering an unhandled exception or a fallback error in the tool call.

Path Filtering Logic: The error path outside working dir suggests that the "Safety Guard" component uses a strict whitelist for the working directory. If the environment is set up under /root/ but the guard expects a standard user path (e.g., /home/user/), it will flag this as a security violation.

Potential Fix/Test:

Could you verify if the command succeeds when run from a non-root directory?

Check if the path normalization logic in the safety guard correctly handles absolute paths starting with /root/.

[MaoJianwei]

I use root user in my linux, and run picoclaw with root user, so the linux permission is ready. @SiYue-ZO

After building, the default workspace is already /root/.picoclaw/workspace, the SKILL and MEMORY work well.

So I think this fake report is caused by a bug, can anyone look into and check the code?

[kunalk16]

Can you share your config.json file after redacting personal details?

[MaoJianwei]

Can you share your config.json file after redacting personal details?

That's too long, which parts do you need? @kunalk16

    "exec": {
      "enabled": true,
      "enable_deny_patterns": true,
      "allow_remote": true,
      "custom_deny_patterns": [],
      "custom_allow_patterns": [],
      "timeout_seconds": 60
    },

  "tools": {
    "allow_read_paths": null,
    "allow_write_paths": null,
    "filter_sensitive_data": true,
    "filter_min_length": 8,
    "web": {
      "enabled": true,
      "brave": {
        "enabled": false,
        "max_results": 5
      },
      "tavily": {
        "enabled": false,
        "base_url": "",
        "max_results": 5
      },
      "duckduckgo": {
        "enabled": true,
        "max_results": 5
      },
      "perplexity": {
        "enabled": false,
        "max_results": 5
      },
      "searxng": {
        "enabled": false,
        "base_url": "",
        "max_results": 5
      },
      "glm_search": {
        "enabled": false,
        "base_url": "https://open.bigmodel.cn/api/paas/v4/web_search",
        "search_engine": "search_std",
        "max_results": 5
      },
      "baidu_search": {
        "enabled": false,
        "base_url": "https://qianfan.baidubce.com/v2/ai_search/web_search",
        "max_results": 10
      },
      "prefer_native": true,
      "fetch_limit_bytes": 10485760,
      "format": "plaintext"
    },

  "agents": {
    "defaults": {
      "workspace": "/root/.picoclaw/workspace",
      "restrict_to_workspace": true,
      "allow_read_outside_workspace": false,
      "provider": "",
      "model_name": "qwen3-coder-next",
      "max_tokens": 32768,
      "context_window": 228000,
      "max_tool_iterations": 999999,
      "summarize_message_threshold": 20,
      "summarize_token_percent": 75,
      "steering_mode": "one-at-a-time",
      "subturn": {
        "max_depth": 0,
        "max_concurrent": 0,
        "default_timeout_minutes": 0,
        "default_token_budget": 0,
        "concurrency_timeout_sec": 0
      },
      "tool_feedback": {
        "enabled": true,
        "max_args_length": 300
      },
      "split_on_marker": false
    }

[kunalk16]

You might wanna change these values:

      "restrict_to_workspace": true,
      "allow_read_outside_workspace": false,

Also these:

      "enable_deny_patterns": true,

[MaoJianwei]

No, I wonder why it is not permitted to work in its workspace? @kunalk16 @afjcjsbx

[MaoJianwei]

Why do you close this issue so urgently? @afjcjsbx

[kunalk16]

Sorry, it was closed on my request as we were expecting this to have been fixed. Have u tried updating all the json properties I have provided?

[MaoJianwei]

Sorry, it was closed on my request as we were expecting this to have been fixed. Have u tried updating all the json properties I have provided?

Changing those can make it work, but it is dangerous.
I want that picoclaw can work in its workspace without security banning. @kunalk16

[MaoJianwei]

I wonder why python3 /root/.picoclaw/workspace/skills/a/scripts/a.py is not permitted to run? It is in the workspace. @kunalk16

[kunalk16]

Keep restrict to workspace as true, allow outside workspace as false and enable deny patterns as false. This would be the right combination for you. The application works in this way. If u have some suggestion, you can raise a feature proposal issue instead about how u r expecting it to be and the benefits.

[MaoJianwei]

OK, the key config item is "enable_deny_patterns": false,, Thanks