{"record":{"id":"592f2a06d9b32cb6","repo":"Hmbown/CodeWhale","slug":"unknown-sandbox-policy-other","errorCode":null,"errorMessage":"Unknown sandbox policy: {other}","messagePattern":"Unknown sandbox policy: (.+?)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/lib.rs","lineNumber":9159,"sourceCode":"    writable_root: Vec<PathBuf>,\n    exclude_tmpdir: bool,\n    exclude_slash_tmp: bool,\n) -> Result<crate::sandbox::SandboxPolicy> {\n    use crate::sandbox::SandboxPolicy;\n\n    match policy {\n        \"danger-full-access\" => Ok(SandboxPolicy::DangerFullAccess),\n        \"read-only\" => Ok(SandboxPolicy::ReadOnly),\n        \"external-sandbox\" => Ok(SandboxPolicy::ExternalSandbox {\n            network_access: network,\n        }),\n        \"workspace-write\" => Ok(SandboxPolicy::WorkspaceWrite {\n            writable_roots: writable_root,\n            network_access: network,\n            exclude_tmpdir,\n            exclude_slash_tmp,\n        }),\n        other => bail!(\"Unknown sandbox policy: {other}\"),\n    }\n}\n\nfn should_use_alt_screen(_cli: &Cli, _config: &Config) -> bool {\n    true\n}\n\nfn should_use_mouse_capture(cli: &Cli, config: &Config, use_alt_screen: bool) -> bool {\n    let terminal_emulator = std::env::var(\"TERMINAL_EMULATOR\").ok();\n    let wt_session = std::env::var(\"WT_SESSION\").ok().filter(|s| !s.is_empty());\n    let conemu_pid = std::env::var(\"ConEmuPID\").ok().filter(|s| !s.is_empty());\n    should_use_mouse_capture_with(\n        cli,\n        config,\n        use_alt_screen,\n        terminal_emulator.as_deref(),\n        wt_session.as_deref(),\n        conemu_pid.as_deref(),","sourceCodeStart":9141,"sourceCodeEnd":9177,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/lib.rs#L9141-L9177","documentation":"parse_sandbox_policy maps exactly four policy names -- danger-full-access, read-only, external-sandbox, workspace-write -- onto SandboxPolicy values; any other string bails with the offending value echoed. It is an allowlist enum parse at the CLI boundary.","triggerScenarios":"`--sandbox foo`, a typo such as workspac-write, an empty string arriving via an unset shell variable, or a policy name that exists only in a different codewhale version.","commonSituations":"Scripts parameterizing the policy; docs drift between versions; copy/paste from another tool's sandbox documentation.","solutions":["Use one of: danger-full-access | read-only | external-sandbox | workspace-write","Echo the variable before passing it to catch empty/whitespace values","Check `--help` for the policy set your version accepts"],"exampleFix":"# before\ncodewhale exec --sandbox workspac-write -- cargo build\n\n# after\ncodewhale exec --sandbox workspace-write -- cargo build","handlingStrategy":"validation","validationCode":"case \"$POLICY\" in\n  danger-full-access|read-only|external-sandbox|workspace-write) ;;\n  *) echo \"unknown sandbox policy '$POLICY'\"; exit 1 ;;\nesac","typeGuard":"const POLICIES: &[&str] = &[\"danger-full-access\", \"read-only\", \"external-sandbox\", \"workspace-write\"];\nfn is_known_policy(p: &str) -> bool { POLICIES.contains(&p) }","tryCatchPattern":null,"preventionTips":["Echo policy variables before use to catch empty or typo'd values","Centralize the allowlist in one constant shared by scripts and docs"],"tags":["sandbox","cli-usage","argument-validation","enum"],"backgroundTag":"invalid-argument-value","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}