Hmbown/CodeWhale · error · anyhow::Error

Command failed with exit code {exit_code}

Error message

Command failed with exit code {exit_code}

What it means

The sandboxed exec runner streams the child's stdout/stderr, prints an extra sandbox-denial hint when the sandbox rejected an operation, and finally converts any non-zero child exit into this error carrying the exit code. The child's own output -- the actual cause -- has already been printed above the bail line.

Source

Thrown at crates/tui/src/lib.rs:9128

        let exit_code = status.code().unwrap_or(-1);
        let sandbox_type = exec_env.sandbox_type;
        let sandbox_denied = SandboxManager::was_denied(sandbox_type, exit_code, &stderr_str);

        if !stdout.is_empty() {
            print!("{}", String::from_utf8_lossy(&stdout));
        }
        if !stderr.is_empty() {
            eprint!("{stderr_str}");
        }
        if sandbox_denied {
            eprintln!(
                "{}",
                SandboxManager::denial_message(sandbox_type, &stderr_str)
            );
        }

        if !status.success() {
            bail!("Command failed with exit code {exit_code}");
        }
    } else {
        let _ = child.kill();
        let _ = child.wait();
        bail!("Command timed out after {}ms", timeout.as_millis());
    }
    Ok(())
}

fn parse_sandbox_policy(
    policy: &str,
    network: bool,
    writable_root: Vec<PathBuf>,
    exclude_tmpdir: bool,
    exclude_slash_tmp: bool,
) -> Result<crate::sandbox::SandboxPolicy> {
    use crate::sandbox::SandboxPolicy;

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Scroll up: the child's stderr above the bail states the underlying failure
2. If a sandbox denial line appeared, widen the policy (workspace-write, extra writable roots) or move the writes inside the workspace
3. Fix the underlying command and re-run
4. Reproduce the command outside the sandbox to separate policy failures from real failures

Example fix

# before
codewhale exec --sandbox read-only -- cargo build   # writes denied, exit code 101

# after
codewhale exec --sandbox workspace-write -- cargo build

match run_sandboxed_exec(cmd, policy, timeout) {
    Err(e) if e.to_string().starts_with("Command failed with exit code") => {
        // child's real stderr was already streamed; inspect logs, then decide:
        // policy denial -> widen sandbox; real failure -> fix command
    }
    Err(e) => return Err(e),
    Ok(()) => {},
}

When it happens

Trigger: Any sandboxed exec run whose command exits non-zero: a failing build/test/lint inside the sandbox, or a tool that errors because the sandbox denied a write or network access it needed.

Common situations: cargo/npm test failures routed through exec; compilers unable to write target/ under a read-only policy; scripts assuming HOME or /tmp writability that the policy excludes.

Related errors

• Command timed out after {}ms
• dsh exited with status {code}
• `codewhale --continue` resumes the interactive TUI. Use `cod
• {flag} must be placed before `exec`. Use: codewhale {flag
• git worktree add failed for branch {} at {}{}{}

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/43f77d090e44bc9c. Report an issue: GitHub.