{"record":{"id":"2ba669a2777f00a0","repo":"Hmbown/CodeWhale","slug":"invalid-sandbox-mode-mode-expected-read-only","errorCode":null,"errorMessage":"Invalid sandbox_mode '{mode}': expected read-only, workspace-write, danger-full-access, or external-sandbox.","messagePattern":"Invalid sandbox_mode '(.+?)': expected read-only, workspace-write, danger-full-access, or external-sandbox\\.","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/config.rs","lineNumber":4438,"sourceCode":"            ) {\n                anyhow::bail!(\n                    \"Invalid approval_policy '{policy}': expected on-request, untrusted, never, auto, or suggest.\"\n                );\n            }\n        }\n        if let Some(v) = self.verbosity.as_deref() {\n            let normalized = v.trim().to_ascii_lowercase();\n            if !matches!(normalized.as_str(), \"normal\" | \"concise\") {\n                anyhow::bail!(\"Invalid verbosity '{v}': expected normal or concise.\");\n            }\n        }\n        if let Some(mode) = self.sandbox_mode.as_deref() {\n            let normalized = mode.trim().to_ascii_lowercase();\n            if !matches!(\n                normalized.as_str(),\n                \"read-only\" | \"workspace-write\" | \"danger-full-access\" | \"external-sandbox\"\n            ) {\n                anyhow::bail!(\n                    \"Invalid sandbox_mode '{mode}': expected read-only, workspace-write, danger-full-access, or external-sandbox.\"\n                );\n            }\n        }\n        if let Some(tui) = &self.tui\n            && let Some(mode) = tui.alternate_screen.as_deref()\n        {\n            let mode = mode.to_ascii_lowercase();\n            if !matches!(mode.as_str(), \"auto\" | \"always\" | \"never\") {\n                anyhow::bail!(\n                    \"Invalid tui.alternate_screen '{mode}': expected auto, always, or never.\"\n                );\n            }\n        }\n        if let Some(auto_review) = &self.auto_review {\n            auto_review.validate()?;\n        }\n        if let Some(providers) = &self.providers {","sourceCodeStart":4420,"sourceCodeEnd":4456,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/8880682c63083a91624de936797efa3ce9e498fd/crates/tui/src/config.rs#L4420-L4456","documentation":"Config::validate() restricts sandbox_mode to read-only, workspace-write, danger-full-access, or external-sandbox (trim + lowercase normalized). This is a security-sensitive enum: a misspelled mode must fail closed rather than silently default to a weaker sandbox.","triggerScenarios":"Typing sandbox_mode = \"write\", \"full\", \"none\", \"full-access\", or \"danger-full\" in config.toml; using a value from an older release whose vocabulary differed.","commonSituations":"Muscle-memory abbreviations from other tools' sandbox flags; hardening review copies a half-remembered mode name; config synced from a version with a different enum.","solutions":["Use exactly one of: read-only, workspace-write, danger-full-access, external-sandbox.","Pick read-only or workspace-write unless you explicitly need danger-full-access.","Re-validate the config after the edit."],"exampleFix":"# before\nsandbox_mode = \"full-access\"\n\n# after\nsandbox_mode = \"danger-full-access\"","handlingStrategy":"validation","validationCode":"fn sandbox_mode_is_valid(raw: &str) -> bool {\n    matches!(\n        raw.trim().to_ascii_lowercase().as_str(),\n        \"read-only\" | \"workspace-write\" | \"danger-full-access\" | \"external-sandbox\"\n    )\n}\n\nif let Some(m) = &config.sandbox_mode {\n    anyhow::ensure!(sandbox_mode_is_valid(m), \"unknown sandbox_mode\");\n}","typeGuard":"fn is_valid_sandbox_mode(raw: &str) -> bool {\n    matches!(\n        raw.trim().to_ascii_lowercase().as_str(),\n        \"read-only\" | \"workspace-write\" | \"danger-full-access\" | \"external-sandbox\"\n    )\n}","tryCatchPattern":"if let Err(e) = config.validate() {\n    let msg = e.to_string();\n    if msg.starts_with(\"Invalid sandbox_mode\") {\n        // fail closed: never guess a mode; prompt the user to pick from the allowed list\n        return Err(e);\n    }\n}","preventionTips":["Treat sandbox_mode typos as security incidents, not cosmetic ones — fix before running.","Default to read-only/workspace-write; require an explicit review to reach danger-full-access.","CI-lint the value against the four-element allowlist."],"tags":["rust","config","toml","validation","sandbox","security"],"backgroundTag":null,"analyzedSha":"8880682c63083a91624de936797efa3ce9e498fd","analyzedAt":"2026-08-16T11:31:27.956Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}