### Fixes

- Agents/sandbox: include the container workspace path hint in sandbox-root escape errors while preserving shortened host workspace roots. Fixes #79712. Thanks @haumanto and @hclsys.

- QQBot: route gateway WebSocket connections through the ambient proxy agent so deployments with `https_proxy`, `HTTPS_PROXY`, or `HTTP_PROXY` can reach the QQ gateway. (#72961) Thanks @xialonglee.

- Agents/subagents: treat `sessions_spawn` `model: "default"` as the default-model fallback and ignore ACP-only stream targets for native sub-agent spawns. Fixes #72078. (#72101) Thanks @xialonglee.

- Agents/failover: stop retrying assistant-prefill format rejections across auth profiles or model fallbacks, surfacing the deterministic provider error instead of requeueing the lane. Fixes #79688. (#79728) Thanks @hclsys.

import os from "node:os";

import path from "node:path";

import { describe, expect, it } from "vitest";

import {

);

});

it("includes container workspace hint without exposing a full home workspace root", () => {

const workspaceDir = path.join(os.homedir(), "workspace-coder");

const sandbox = createSandbox({

workspaceDir,

agentWorkspaceDir: workspaceDir,

});

const mounts = buildSandboxFsMounts(sandbox);

let thrown: unknown;

try {

resolveSandboxFsPathWithMounts({

filePath: "/tmp/outside",

cwd: sandbox.workspaceDir,

defaultWorkspaceRoot: sandbox.workspaceDir,

defaultContainerRoot: sandbox.containerWorkdir,

mounts,

});

} catch (error) {

thrown = error;

}

expect(thrown).toBeInstanceOf(Error);

const message = (thrown as Error).message;

expect(message).toContain(

"Path escapes sandbox root (~/workspace-coder; container root /workspace): /tmp/outside",

);

expect(message).toContain("Use a path under /workspace/ instead.");

expect(message).not.toContain(os.homedir());

});

it("prefers custom bind mounts over default workspace mount at /workspace", () => {

const sandbox = createSandbox({

docker: {

import os from "node:os";

import path from "node:path";

import { isPathInside } from "../../infra/path-guards.js";

import { normalizeOptionalLowercaseString } from "../../shared/string-coerce.js";

defaultContainerRoot: string;

}): string {

const containerRoot = normalizeContainerPath(params.defaultContainerRoot);

return `Path escapes sandbox root (${params.defaultWorkspaceRoot}; container root ${containerRoot}): ${params.input}. Use a path under ${containerRoot}/ instead.`;

const workspaceRoot = shortenHomePath(path.resolve(params.defaultWorkspaceRoot));

return `Path escapes sandbox root (${workspaceRoot}; container root ${containerRoot}): ${params.input}. Use a path under ${containerRoot}/ instead.`;

}

function shortenHomePath(value: string): string {

const home = os.homedir();

if (value === home || value.startsWith(`${home}${path.sep}`)) {

return `~${value.slice(home.length)}`;

}

return value;

}

function compareMountsByContainerPath(a: SandboxFsMount, b: SandboxFsMount): number {