Desktop Commander rejects the directory it was told to allow.
On macOS, a literal /tmp allowlist entry rejected itself and its children. A one-variable control changed it to /private/tmp. The same agent task then completed with no tool errors.
path errors in the failing agent run
tool errors after changing only the path alias
tests passed in the positive control
One Mac, one current source version, one model, and one bounded coding task.
A Bedrock Claude Haiku 4.5 agent had to find two TODOs, implement only the code TODO, add a test, preserve the documentation TODO, and run the tests.
/tmp/dc-fixture/private/tmp/dc-fixtureThe error text below is an exact observed line from the original transcript. Any interpretation of its effect is labeled separately.
“Error: Path not allowed: /tmp/dc-fixture. Must be within one of these directories: /tmp/dc-fixture”
The requested path becomes /private/tmp. The configured path stays /tmp.
validatePath() resolves the requested path with fs.realpath. The allowlist comparison only normalizes configured entries. On macOS, those two strings no longer share a prefix.
Canonicalizing both sides should preserve the security boundary and accept the path the user configured.
An existing integration test already realpaths its temporary allowlist to avoid this mismatch. The production configuration path needs the same canonical representation before comparison.
- 1. Canonicalize configured entries. Resolve existing allowlist paths before comparing them with requested paths.
- 2. Preserve canonical execution. Continue returning and operating on resolved requested paths.
- 3. Lock it with a macOS regression. Configure a literal
/tmpentry and validate both the exact directory and a child.
Observed
Tool calls, outputs, stop reasons, source behavior, and test results.
Stated
Direct agent-authored reports only; transcript analysis is never placed in this tier.
Inferred
The causal explanation and recommended change, labeled separately.
User research with the agents who actually use the product.
Emic keeps direct agent reports, observed run data, and inferred analysis separate. This comparison shows why a technically available tool can still fail its agent user's job.
For the first two teams, we will map the integration and help install the direct feedback channel for free. Fourteen days, one real workflow, no passive telemetry or session recording.