fix(sandbox): tolerate transient workspace removals

Author: RoyLin

.github/workflows/release.yml

@@ -18,7 +18,7 @@ env:
   A3S_WEB_SOURCE_REF: 6e894ce4f0921c89329a7cba30397ff5ac8b6f9a
   # Exact companion prerequisite; preflight rejects an absent or incomplete release.
   A3S_WEBVIEW_VERSION: 0.1.5
-  A3S_CODE_CORE_VERSION: 6.4.0
+  A3S_CODE_CORE_VERSION: 6.4.1
   A3S_SEARCH_VERSION: 2.1.0
   A3S_TUI_VERSION: 0.1.13
   A3S_USE_EXTENSION_VERSION: 0.2.0

CHANGELOG.md

@@ -7,10 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.10.3] - 2026-07-23
+
 ### Fixed
 
 - Trusted the official A3S tap before release smoke installation so current
   Homebrew versions can resolve the tap-owned `a3s-webview` dependency.
+- Updated Core so the managed SRT capability handshake tolerates files and
+  directories removed concurrently by other workspace processes.
+- Included the complete causal error chain in local-sandbox startup warnings
+  instead of hiding the actionable workspace or platform failure.
 
 ## [0.10.2] - 2026-07-23
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s"
-version = "0.10.2"
+version = "0.10.3"
 edition = "2021"
 description = "a3s — A3S coding agent CLI; `a3s code` launches the interactive TUI"
 license = "MIT"
@@ -14,7 +14,7 @@ name = "a3s"
 path = "src/main.rs"
 
 [dependencies]
-a3s-code-core = "=6.4.0"
+a3s-code-core = "=6.4.1"
 a3s-boot = { version = "=0.1.3", features = ["ilink"] }
 a3s-lane = "=0.5.1"
 # Long-term memory store (same crate/version a3s-code-core uses) — the `/ctx save`

Cargo.toml

@@ -1286,6 +1286,8 @@ Offline mode and `A3S_NO_AUTO_INSTALL=1` can use either verified state or the
 verified release payload but forbid registry bootstrap. Setup failure remains
 non-fatal: Default can ask for one exact host Bash invocation and Auto denies
 Bash. There is no silent unsandboxed fallback.
+Startup warnings include the complete causal error chain so a workspace scan,
+runtime verification, or platform failure remains actionable.
 
 The local sandbox denies command network egress, local binding, and Unix
 sockets; allows writes only in the active workspace and a private per-run
@@ -1296,7 +1298,8 @@ process-group cancellation, bounded output, and streaming deltas use the same
 contract as the normal Bash tool. Existing `.env*` files are denied at every
 governed source-tree depth, and pre-existing multi-link source files are masked
 for both reads and writes so a workspace hardlink cannot expose an outside
-inode.
+inode. Workspace policy scans tolerate an entry removed concurrently after
+enumeration while permission and other I/O failures remain fatal.
 
 The TUI also enables Core's local workspace credential policy for in-process
 tools. `read`, range reads, `grep`, `write`, `edit`, and `patch` therefore

README.md

@@ -8,6 +8,14 @@ const CODE_INTELLIGENCE_SHUTDOWN_GRACE: Duration = Duration::from_secs(5);
 const CODE_INTELLIGENCE_SHUTDOWN_SETTLE: Duration = Duration::from_secs(1);
 const CODE_INTELLIGENCE_ABORT_SETTLE: Duration = Duration::from_millis(250);
 
+fn sandbox_load_warning(error: &anyhow::Error) -> String {
+    format!(
+        "Local command sandbox failed its bounded OS capability probe: {error:#}. \
+         Default mode will ask before exact host Bash execution; Auto mode will deny \
+         Bash. Repair the reported platform prerequisite and restart `a3s code`"
+    )
+}
+
 fn with_tui_prompt_context(
     options: SessionOptions,
     instructions: Option<&str>,
@@ -688,14 +696,7 @@ pub(crate) async fn run_in(
                 Some(Arc::new(sandbox) as Arc<dyn a3s_code_core::sandbox::BashSandbox>),
                 None,
             ),
-            Err(error) => (
-                None,
-                Some(format!(
-                    "Local command sandbox failed its bounded OS capability probe: {error}. \
-                     Default mode will ask before exact host Bash execution; Auto mode will deny \
-                     Bash. Repair the reported platform prerequisite and restart `a3s code`"
-                )),
-            ),
+            Err(error) => (None, Some(sandbox_load_warning(&error))),
         },
         None => (None, managed_srt.warning),
     };
@@ -1380,6 +1381,19 @@ mod tests {
         assert!(rendered.contains("a3s code resume session-42"));
     }
 
+    #[test]
+    fn sandbox_warning_includes_the_complete_error_chain() {
+        let error = anyhow::anyhow!("No such file or directory (os error 2)")
+            .context("failed to scan SRT workspace /workspace/transient")
+            .context("managed SRT failed its Core capability handshake");
+
+        let warning = sandbox_load_warning(&error);
+
+        assert!(warning.contains("managed SRT failed its Core capability handshake"));
+        assert!(warning.contains("failed to scan SRT workspace /workspace/transient"));
+        assert!(warning.contains("No such file or directory (os error 2)"));
+    }
+
     #[tokio::test]
     async fn initial_tui_options_inject_and_remove_materialized_preferences() {
         let temp = tempfile::tempdir().unwrap();