[DZH166]

Problem

SandboxFileOperator.exists() and is_directory() interpolate the path straight into a shell command:

result = await self.sandbox_client.run_command(
    f"test -e {path} && echo 'true' || echo 'false'"
)

Any path that is not a single bare word breaks the check, and shell metacharacters are interpreted:

exists("my dir/file.txt")   -> test -e my dir/file.txt && ...
                               (shlex tokens: test -e my dir/file.txt -> two arguments, always "false")
is_directory("a; echo x")   -> the second command runs inside the sandbox

Every caller (BaseAgent, str_replace_editor, sandbox tool wrappers) passes user/model-derived paths, so workspace files with spaces are reported as missing, and a crafted path can execute arbitrary commands inside the sandbox.

Fix

Pass shlex.quote(str(path)) in both checks.

Tests

tests/sandbox/test_file_operator_quoting.py (2 tests, fake sandbox client that records the command):

pytest tests/sandbox/test_file_operator_quoting.py -q    # before: 2 failed   after: 2 passed