{"record":{"id":"0025c9162da47bed","repo":"JuliusBrussee/caveman","slug":"cave-sandbox-os-network-isolation-unavailable","errorCode":null,"errorMessage":"cave_sandbox_os_network_isolation_unavailable","messagePattern":"cave_sandbox_os_network_isolation_unavailable","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/agent/src/sandbox-network.ts","lineNumber":65,"sourceCode":"        ...nodeArgs,\n      ],\n    };\n  }\n  if (process.platform === \"linux\") {\n    return {\n      command: \"/usr/bin/unshare\",\n      args: [\n        \"--user\",\n        \"--map-root-user\",\n        \"--net\",\n        \"--\",\n        process.execPath,\n        \"--no-addons\",\n        ...nodeArgs,\n      ],\n    };\n  }\n  throw new Error(\"cave_sandbox_os_network_isolation_unavailable\");\n}\n","sourceCodeStart":47,"sourceCodeEnd":67,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/packages/agent/src/sandbox-network.ts#L47-L67","documentation":"networkIsolatedNode returns an OS-level network-isolation wrapper command (sandbox-exec on macOS, unshare --net on Linux) and throws this error on any other platform. The sandbox needs kernel-level network containment for tool workers; Windows and other non-darwin/linux platforms have no supported wrapper, so the request fails closed rather than running unsandboxed.","triggerScenarios":"Requesting an OS-network-isolated sandboxed run (required-sandbox policy with network isolation) on Windows or any platform where process.platform is neither \"darwin\" nor \"linux\".","commonSituations":"Developing on Windows (including WSL-confused setups where the host Node reports win32); CI runners on unsupported platforms; expecting the in-process installNetworkDeny() shim to suffice where the OS wrapper is required.","solutions":["Run sandboxed builds on Linux or macOS; on Windows use WSL so Node reports platform \"linux\".","Verify sandbox readiness with the doctor CLI before attempting the run — missing sandbox support is reported there.","If your policy allows it, use a sandbox mode that does not require OS network isolation rather than weakening the required policy silently."],"exampleFix":"// before\nconst plan = await compile(agent, { sandbox: \"required\" }); // on Windows\n\n// after\n// run under WSL/Linux, or gate on platform:\nif (process.platform !== \"darwin\" && process.platform !== \"linux\") {\n  throw new Error(\"OS network isolation unsupported here; use WSL or Linux\");\n}","handlingStrategy":"validation","validationCode":"function osNetworkIsolationAvailable(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"linux\";\n}\nif (!osNetworkIsolationAvailable()) {\n  throw new Error(`OS network isolation unavailable on ${process.platform}; use Linux, macOS, or WSL`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await buildWithRequiredSandbox(agent);\n} catch (error) {\n  if (error instanceof Error && error.message === \"cave_sandbox_os_network_isolation_unavailable\") {\n    // fail closed by design: switch environment, do not drop the sandbox policy\n  } else throw error;\n}","preventionTips":["Gate required-sandbox builds on process.platform being darwin or linux.","On Windows, run inside WSL so Node reports platform \"linux\".","Use the doctor CLI to check sandbox readiness in CI before locked builds."],"tags":["sandbox","platform","windows","network"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}