What causes "Unknown sandbox policy: {other}" in Hmbown/CodeWhale?

Hmbown/CodeWhale · error · anyhow::Error

Unknown sandbox policy: {other}

Error message

Unknown sandbox policy: {other}

What it means

parse_sandbox_policy maps exactly four policy names -- danger-full-access, read-only, external-sandbox, workspace-write -- onto SandboxPolicy values; any other string bails with the offending value echoed. It is an allowlist enum parse at the CLI boundary.

Source

Thrown at crates/tui/src/lib.rs:9159

    writable_root: Vec<PathBuf>,
    exclude_tmpdir: bool,
    exclude_slash_tmp: bool,
) -> Result<crate::sandbox::SandboxPolicy> {
    use crate::sandbox::SandboxPolicy;

    match policy {
        "danger-full-access" => Ok(SandboxPolicy::DangerFullAccess),
        "read-only" => Ok(SandboxPolicy::ReadOnly),
        "external-sandbox" => Ok(SandboxPolicy::ExternalSandbox {
            network_access: network,
        }),
        "workspace-write" => Ok(SandboxPolicy::WorkspaceWrite {
            writable_roots: writable_root,
            network_access: network,
            exclude_tmpdir,
            exclude_slash_tmp,
        }),
        other => bail!("Unknown sandbox policy: {other}"),
    }
}

fn should_use_alt_screen(_cli: &Cli, _config: &Config) -> bool {
    true
}

fn should_use_mouse_capture(cli: &Cli, config: &Config, use_alt_screen: bool) -> bool {
    let terminal_emulator = std::env::var("TERMINAL_EMULATOR").ok();
    let wt_session = std::env::var("WT_SESSION").ok().filter(|s| !s.is_empty());
    let conemu_pid = std::env::var("ConEmuPID").ok().filter(|s| !s.is_empty());
    should_use_mouse_capture_with(
        cli,
        config,
        use_alt_screen,
        terminal_emulator.as_deref(),
        wt_session.as_deref(),
        conemu_pid.as_deref(),

View on GitHub (pinned to 0c42157ee5)

Solutions

Use one of: danger-full-access | read-only | external-sandbox | workspace-write
Echo the variable before passing it to catch empty/whitespace values
Check `--help` for the policy set your version accepts

Example fix

# before
codewhale exec --sandbox workspac-write -- cargo build

# after
codewhale exec --sandbox workspace-write -- cargo build

Defensive patterns

Strategy: validation

Validate before calling

case "$POLICY" in
  danger-full-access|read-only|external-sandbox|workspace-write) ;;
  *) echo "unknown sandbox policy '$POLICY'"; exit 1 ;;
esac

Type guard

const POLICIES: &[&str] = &["danger-full-access", "read-only", "external-sandbox", "workspace-write"];
fn is_known_policy(p: &str) -> bool { POLICIES.contains(&p) }

Prevention

Echo policy variables before use to catch empty or typo'd values
Centralize the allowlist in one constant shared by scripts and docs

When it happens

Trigger: `--sandbox foo`, a typo such as workspac-write, an empty string arriving via an unset shell variable, or a policy name that exists only in a different codewhale version.

Common situations: Scripts parameterizing the policy; docs drift between versions; copy/paste from another tool's sandbox documentation.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/592f2a06d9b32cb6. Report an issue: GitHub.