---
url: >-
  https://adk.nht.io/api/@nhtio/adk/batteries/sandbox/functions/classifySandboxPathRejection.md
---

# Function: classifySandboxPathRejection()

```ts
function classifySandboxPathRejection(
  input: string,
): SandboxPathRejection | undefined;
```

Defined in: [src/batteries/sandbox/paths.ts:27](https://github.com/NHTIO/ADK/blob/v1.20260824.1/src/src/batteries/sandbox/paths.ts#L27)

Classify an unambiguous host escape, or `undefined` when the path is acceptable.

## Parameters

| Parameter | Type     | Description                                |
| --------- | -------- | ------------------------------------------ |
| `input`   | `string` | The model-supplied path, exactly as given. |

## Returns

| [`SandboxPathRejection`](../type-aliases/SandboxPathRejection.md)
| `undefined`

The rejection reason, or `undefined` to continue normalising.

## Remarks

The REASON is returned, not just a boolean, because the narrated outcome carries it and the model
acts on it: "paths are workspace-relative" is useless advice for a NUL byte, and a UNC form needs
a different correction from a `~`. Reporting every rejection as `escape` collapses five distinct
mistakes into one unhelpful message.

ORDER IS LOAD-BEARING and matches the plan's step 1. Recognition runs on the CANONICAL separator
representation (both `/` and `\` treated as separators) but still BEFORE any stripping, so a
slash-mixed form like `/\server\share` cannot slip past a naive prefix test and then become a
root-relative path once separators are collapsed. UNC is distinguished from merely-repeated
leading separators by having a NON-EMPTY first segment. Nothing is percent-decoded and nothing is
case-folded: a literal `%2e%2e` is a filename, not traversal.