Summary / Problem Statement

In splitSandboxBindSpec, the parser splits Docker-style bind specifications (host:container[:options]). On Windows, drive-letter paths start with a colon (e.g. C:\... or C:/...). To prevent splitting on the drive-letter colon, the parser uses a helper function getHostContainerSeparatorIndex which skips the first colon if it matches a drive prefix.

However, the regular expression used to match the drive-letter prefix is:

const hasDriveLetterPrefix = /^[A-Za-z]:[\\/]/.test(spec);

This regex explicitly requires a slash or backslash after the colon. Windows also supports relative drive-letter paths (e.g. C:project:\workspace or C:Users\name), which do not have a slash immediately after the colon.

Because of this slash requirement, hasDriveLetterPrefix evaluates to false for relative drive-letter specs. The loop then starts searching for colons from index 0, matches the colon at index 1 (the drive-letter colon), and incorrectly splits the specification, resulting in:

• Host path: C
• Container path: project:\workspace

This completely breaks downstream path validation and sandbox mounting security gates.

Detailed Technical Context

• Affected Parser: In src/agents/sandbox/bind-spec.ts:

  function getHostContainerSeparatorIndex(spec: string): number {
    const hasDriveLetterPrefix = /^[A-Za-z]:[\\/]/.test(spec);
    // A leading `C:\` or `C:/` colon is part of the host path, not the bind separator.
    for (let i = hasDriveLetterPrefix ? 2 : 0; i < spec.length; i += 1) {
      if (spec[i] === ":") {
        return i;
      }
    }
    return -1;
  }

• If the user passes C:project:/workspace, it splits at index 1, leading to a host path of C (which is treated as a relative path and rejected by absolute path checks in validateBindMounts).

Impact Analysis

• Windows users trying to bind relative paths using drive-letter notation (e.g., C:project:/workspace) will have their binds rejected with non_absolute path security exceptions.
• It prevents standard dev workflows where relative paths scoped to a drive are mounted into container workspaces.

Proposed Solution / Implementation Plan

1. Fix Prefix Detection: Relax the regex constraint in getHostContainerSeparatorIndex to check if the colon at index 1 is followed by any character other than the bind separator itself, or specifically handle alphanumeric drives:

   const hasDriveLetterPrefix = /^[A-Za-z]:[^:]/.test(spec);

2. Windows Path Normalization: Ensure drive-letter prefixes without slashes are expanded or resolved to their absolute directory form before being passed to the validator.

Affected File References

• src/agents/sandbox/bind-spec.ts
• src/agents/sandbox/validate-sandbox-security.ts