From f7576d7eccf801fd5a7fc9854046d45f801abd19 Mon Sep 17 00:00:00 2001
From: Gutslabs <gutslabsxyz@gmail.com>
Date: Mon, 30 Mar 2026 16:17:07 +0300
Subject: [PATCH] fix(daytona): quote sync paths before shell mkdir

---
 tests/tools/test_daytona_environment.py | 19 +++++++++++++++++++
 tools/environments/daytona.py           |  3 ++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/tests/tools/test_daytona_environment.py b/tests/tools/test_daytona_environment.py
index 04e6347955cf8..fe165f221059b 100644
--- a/tests/tools/test_daytona_environment.py
+++ b/tests/tools/test_daytona_environment.py
@@ -1,6 +1,8 @@
 """Unit tests for the Daytona cloud sandbox environment backend."""
 
+import shlex
 import threading
+from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch, PropertyMock
 
@@ -321,6 +323,23 @@ def test_daytona_error_triggers_retry(self, make_env, daytona_sdk):
         assert result["returncode"] == 0
 
 
+class TestSyncSafety:
+    def test_upload_if_changed_quotes_parent_path(self, make_env, tmp_path):
+        env = make_env()
+        env._sandbox.process.exec.reset_mock()
+
+        host_file = tmp_path / "token.txt"
+        host_file.write_text("secret", encoding="utf-8")
+        remote_path = "/root/.hermes/skills/evil; touch /tmp/daytona-owned/file.txt"
+
+        uploaded = env._upload_if_changed(str(host_file), remote_path)
+
+        assert uploaded is True
+        expected_parent = str(Path(remote_path).parent)
+        mkdir_cmd = env._sandbox.process.exec.call_args_list[0][0][0]
+        assert mkdir_cmd == f"mkdir -p {shlex.quote(expected_parent)}"
+
+
 # ---------------------------------------------------------------------------
 # Resource conversion
 # ---------------------------------------------------------------------------
diff --git a/tools/environments/daytona.py b/tools/environments/daytona.py
index eb2a673110680..14acc79a63247 100644
--- a/tools/environments/daytona.py
+++ b/tools/environments/daytona.py
@@ -12,6 +12,7 @@
 import threading
 import uuid
 import warnings
+from pathlib import Path
 from typing import Optional
 
 from tools.environments.base import BaseEnvironment
@@ -144,7 +145,7 @@ def _upload_if_changed(self, host_path: str, remote_path: str) -> bool:
             return False
         try:
             parent = str(Path(remote_path).parent)
-            self._sandbox.process.exec(f"mkdir -p {parent}")
+            self._sandbox.process.exec(f"mkdir -p {shlex.quote(parent)}")
             self._sandbox.fs.upload_file(host_path, remote_path)
             self._synced_files[remote_path] = file_key
             return True