fix: reject empty --mount paths

An empty or whitespace-only --mount value resolves to the current working
directory and would silently bind-mount it into the sandbox. Reject it.

strix/interface/utils.py

@@ -1262,10 +1262,13 @@ def build_mount_targets_info(mount_paths: list[str]) -> list[dict[str, Any]]:
 
     Each path must be an existing local directory; it is bind-mounted into the
     sandbox (read-only) instead of being copied file-by-file. Raises
-    ``ValueError`` for a path that does not exist or is not a directory.
+    ``ValueError`` for an empty path, or one that does not exist or is not a
+    directory.
     """
     targets_info: list[dict[str, Any]] = []
     for raw in mount_paths:
+        if not raw or not raw.strip():
+            raise ValueError("--mount path must not be empty.")
         path = Path(raw).expanduser()
         try:
             resolved = path.resolve()

tests/test_local_sources.py

@@ -114,3 +114,11 @@ def test_build_mount_targets_info_rejects_file(tmp_path: Path) -> None:
     _write_file(file_path, 10)
     with pytest.raises(ValueError, match="not an existing directory"):
         build_mount_targets_info([str(file_path)])
+
+
+@pytest.mark.parametrize("empty", ["", "   "])
+def test_build_mount_targets_info_rejects_empty_path(empty: str) -> None:
+    # An empty path would otherwise resolve to the current working directory
+    # and silently bind-mount it into the sandbox.
+    with pytest.raises(ValueError, match="must not be empty"):
+        build_mount_targets_info([empty])