{"record":{"id":"5d0c1df6a340c50b","repo":"astrid-runtime/astrid","slug":"invalid-process-allow-entry-entry-e","errorCode":null,"errorMessage":"invalid --process-allow entry {entry:?}: {e}","messagePattern":"invalid --process-allow entry (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/agent/mod.rs","lineNumber":448,"sourceCode":"/// grammar (no dots in segments, etc.). Catching invalid labels here\n/// — before any IPC — prevents the kernel from accepting the agent\n/// profile and then rejecting the follow-up grant, which would leave a\n/// half-provisioned agent on disk.\nfn build_caps_to_grant(args: &CreateArgs) -> Result<Vec<String>> {\n    let mut caps: Vec<String> = Vec::new();\n    if let Some(domains) = args.egress.as_deref() {\n        for entry in domains.split(',').map(str::trim).filter(|s| !s.is_empty()) {\n            let cap = format!(\"network:egress:{entry}\");\n            astrid_core::capability_grammar::validate_capability(&cap)\n                .map_err(|e| anyhow::anyhow!(\"invalid --egress entry {entry:?}: {e}\"))?;\n            caps.push(cap);\n        }\n    }\n    if let Some(cmds) = args.process_allow.as_deref() {\n        for entry in cmds.split(',').map(str::trim).filter(|s| !s.is_empty()) {\n            let cap = format!(\"process:spawn:{entry}\");\n            astrid_core::capability_grammar::validate_capability(&cap)\n                .map_err(|e| anyhow::anyhow!(\"invalid --process-allow entry {entry:?}: {e}\"))?;\n            caps.push(cap);\n        }\n    }\n    Ok(caps)\n}\n\n/// Apply the parsed quota deltas: `QuotaGet` to pull the new agent's\n/// defaults, replay each requested field, single `QuotaSet`. A failure\n/// here leaves the agent in place with default quotas — operator can\n/// re-run `astrid quota set -a <name> ...` to retry.\nasync fn apply_initial_quotas(\n    client: &mut AdminClient,\n    principal: &PrincipalId,\n    updates: &[QuotaField],\n) -> Result<()> {\n    let body = client\n        .request(AdminRequestKind::QuotaGet {\n            principal: principal.clone(),","sourceCodeStart":430,"sourceCodeEnd":466,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/agent/mod.rs#L430-L466","documentation":"Raised in build_caps_to_grant when a --process-allow entry fails astrid_core::capability_grammar::validate_capability after being formatted as 'process:spawn:{entry}'. The capability grammar validator rejects binaries or path patterns that are not valid spawn capability tokens.","triggerScenarios":"Passing --process-allow with an entry containing invalid characters, absolute paths where bare binary names are required (or vice versa), globs the grammar rejects, or empty/whitespace remnants after comma-splitting.","commonSituations":"Listing system binaries with full paths including spaces ('/usr/bin/my tool'), using shell-style wildcards unsupported by the grammar, or copy-pasting a comma-separated list with stray characters.","solutions":["Correct the --process-allow entry to satisfy the process:spawn capability grammar","Read the validate_capability error suffix for the exact rule violated","Quote the argument and avoid unescaped shell glob expansion"],"exampleFix":"// before\n--process-allow '/usr/bin/my tool'\n// after\n--process-allow 'my-tool'","handlingStrategy":"validation","validationCode":"let cap = format!(\"process:spawn:{entry}\");\nif astrid_core::capability_grammar::validate_capability(&cap).is_err() { eprintln!(\"invalid process-allow entry: {entry}\"); std::process::exit(2); }","typeGuard":"fn valid_spawn(entry: &str) -> bool { astrid_core::capability_grammar::validate_capability(&format!(\"process:spawn:{entry}\")).is_ok() }","tryCatchPattern":"if let Err(e) = build_caps_to_grant(&args) { eprintln!(\"{e:#}\"); std::process::exit(2); }","preventionTips":["Use bare binary names in the form the grammar expects","Avoid spaces and shell globs in --process-allow entries","Quote multi-entry lists: --process-allow 'git,cargo,rustc'"],"tags":["cli","validation","capability-grammar"],"backgroundTag":"invalid-argument-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}