JuliusBrussee/caveman · critical · Error

cave_sandbox_conformance_failed

Error message

cave_sandbox_conformance_failed

What it means

Immediately before the expensive compile step, build re-runs verifySandboxConformance() and hard-fails if the containment probe returns false. This is the same probe doctor reports on (cli.ts:152), but at build time it is a gate, not a diagnostic: a build cannot be produced on a host where the tool sandbox does not contain its probe, because the produced build would be unshippable for sandbox-required tools.

Source

Thrown at packages/agent/src/cli.ts:748

    preferredTransforms,
    transformRegistry.capabilities,
    evalDynamicKinds(approved),
    {
      ...(loaded.config.allowedModels === undefined ? {} : { allowedModels: loaded.config.allowedModels }),
      ...(loaded.config.deniedModels === undefined ? {} : { deniedModels: loaded.config.deniedModels }),
      ...(loaded.config.forbiddenSafetyClasses === undefined
        ? {}
        : { forbiddenSafetyClasses: loaded.config.forbiddenSafetyClasses }),
    },
  );
  const entitled = await engineEntitled();
  const plannedRuns = candidates.filter((candidate) => !candidate.static_rejection).length * approved.length * 5;
  const estimatedCeiling = candidates
    .filter((candidate) => !candidate.static_rejection)
    .reduce((sum, candidate) => sum + candidate.estimated_cost_usd_per_run * approved.length * 5, 0);
  process.stdout.write(`search ceiling: $${estimatedCeiling.toFixed(4)} public-catalog estimate · ${plannedRuns} runs\n`);
  const sandboxConformance = await verifySandboxConformance();
  if (!sandboxConformance) throw new Error("cave_sandbox_conformance_failed");
  const privacyConformance = contextIRIsContentBlind(lowered.ir);
  if (!privacyConformance) throw new Error("cave_privacy_conformance_failed");
  const conversations = new Map<string, ConversationState>();
  const result = await compileAndWrite({
    agent: loaded.agent,
    contextIR: lowered.ir,
    evals: loaded.evals,
    candidates,
    baselinePlan: baseline,
    seeds: [1, 2, 3, 4, 5],
    config: loaded.config,
    entitled,
    sourceSha256: loaded.sourceSha256,
    catalogSha256: CATALOG_SHA256,
    transformRegistrySha256: transformRegistry.sha256,
    runtimeVersion: FRAMEWORK_VERSION,
    adapterVersion: PI_ADAPTER_VERSION,
    upstreamVersion: PI_UPSTREAM_VERSION,

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Fix the environment first: enable unprivileged user namespaces / required sandbox syscalls, or move to a supported runtime (WSL2 on Windows).
2. Verify with `caveman-agent doctor` — its sandbox check must pass before retrying build.
3. Never work around by forcing fixture mode for production builds; fixture sandbox is only for local development and doctor's fix text calls this out.

Example fix

# before: hardened CI container
# (seccomp blocks clone3/userns → probe false → build throws)
docker run --security-opt seccomp=default my-ci caveman-agent build

# after: run with the runtime's sandbox-capable profile
docker run --security-opt seccomp=unconfined my-ci caveman-agent doctor && \
  docker run --security-opt seccomp=unconfined my-ci caveman-agent build

import { verifySandboxConformance } from "@caveman/agent";
async function assertBuildableEnvironment(): Promise<void> {
  if (!(await verifySandboxConformance())) {
    throw new Error("sandbox containment failed — fix host environment (userns/seccomp/WSL2) before build");
  }
}

try {
  await build(["caveman.config.ts"]);
} catch (error) {
  if (error instanceof Error && error.message === "cave_sandbox_conformance_failed") {
    // Environment blocker, raised before compileAndWrite — no partial build is written.
    // Fix the host (enable unprivileged userns / WSL2 / supported runtime) and re-run.
    process.exitCode = 2;
  }
  throw error;
}

When it happens

Trigger: Running `caveman-agent build` on a host whose sandbox fails containment: disabled unprivileged user namespaces, restricted container runtime, sandbox compiled/running in fixture mode, or an OS without the required sandboxing facility. Occurs after config/eval/source loading and the cost-ceiling print, right before compileAndWrite.

Common situations: CI containers with hardened seccomp profiles; Debian-based images with kernel.unprivileged_userns_clone=0; macOS/Windows native hosts without the sandbox backend; gVisor/microVM runtimes missing needed syscalls.

Related errors

• probe returned false
• cave_sandbox_credential_env_not_allowlisted
• cave_sandbox_credential_missing
• caveman build: config must use strict lock and required sand
• cave_live_eval_sandbox_profile_missing

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/20215d574b6932da. Report an issue: GitHub.