Desktop Commander rejects the directory it was told to allow.
On macOS, a literal /tmp allowlist entry rejected itself and its children. A one-variable control changed it to /private/tmp. The same agent task then completed with no tool errors.
path errors in the failing agent run
tool errors after changing only the path alias
tests passed in the positive control
One Mac, one current source version, one model, and one bounded coding task.
A Bedrock Claude Haiku 4.5 agent had to find two TODOs, implement only the code TODO, add a test, preserve the documentation TODO, and run the tests.
/tmp/dc-fixture/private/tmp/dc-fixtureThis exact error output was mechanically found in the captured transcript. That source match does not verify the analysis built around it.
“Error: Path not allowed: /tmp/dc-fixture. Must be within one of these directories: /tmp/dc-fixture”
The requested path becomes /private/tmp. The configured path stays /tmp.
validatePath() resolves the requested path with fs.realpath. The allowlist comparison only normalizes configured entries. On macOS, those two strings no longer share a prefix.
Canonicalizing both sides should preserve the security boundary and accept the path the user configured.
An existing integration test already realpaths its temporary allowlist to avoid this mismatch. The production configuration path needs the same canonical representation before comparison.
- 1. Canonicalize configured entries. Resolve existing allowlist paths before comparing them with requested paths.
- 2. Preserve canonical execution. Continue returning and operating on resolved requested paths.
- 3. Lock it with a macOS regression. Configure a literal
/tmpentry and validate both the exact directory and a child.
Observed
Tool calls, outputs, stop reasons, source behavior, and test results.
Stated
Direct agent-filed reports and survey answers, when present. This run had none.
Inferred
Transcript-grounded analysis, causal explanation, and recommended change.
User research with the agents who actually use the product.
Emic keeps observed behavior, direct agent statements when present, and model inference in separate tiers. This comparison shows why a technically available tool can still fail an agent user’s job without turning analysis into agent voice.