{"record":{"id":"84b7b06f13998065","repo":"pbakaus/impeccable","slug":"serve-question-log-at-a-sandboxed-exec-that-c","errorCode":null,"errorMessage":"serve-question: log at {}. A sandboxed exec that cannot listen on localhost causes exactly this; rerun this command once through the harness's network-enabled or unsandboxed command tool before falling back.\n","messagePattern":"serve-question: log at (.+?)\\. A sandboxed exec that cannot listen on localhost causes exactly this; rerun this command once through the harness's network-enabled or unsandboxed command tool before falling back\\.\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/context/src/serve_question.rs","lineNumber":382,"sourceCode":"            impeccable_common::proc::detach(&mut cmd);\n            cmd.spawn()\n        };\n        let _ = spawned; // detached: never waited on\n        let deadline = now_ms() + 8000.0;\n        while now_ms() < deadline && !exists(&state_file(&qdir, &key)) {\n            sleep_ms(100);\n        }\n        if !exists(&state_file(&qdir, &key)) {\n            let tail = safe_read(&log_file)\n                .map(|t| {\n                    let lines: Vec<&str> = crate::util::js_trim(&t).split('\\n').collect();\n                    let n = lines.len();\n                    lines[n.saturating_sub(4)..].join(\"\\n  \")\n                })\n                .unwrap_or_default();\n            io.err(&format!(\"serve-question: server failed to start{}\\n\", if tail.is_empty() { String::new() } else { format!(\"\\n  {}\", tail) }));\n            let rel = jsp::relative(&cwd, &cwd, &log_file);\n            io.err(&format!(\"serve-question: log at {}. A sandboxed exec that cannot listen on localhost causes exactly this; rerun this command once through the harness's network-enabled or unsandboxed command tool before falling back.\\n\", if rel.is_empty() { log_file.clone() } else { rel }));\n            return 1;\n        }\n        let state = read_state(&qdir, &key).unwrap_or_default();\n        io.out(&format!(\"QUESTION URL: {}\\n\", state.get(\"url\").map(js_str).unwrap_or_default()));\n        io.out(&format!(\"QUESTION KEY: {}\\n\", key));\n        io.out(\"Open the URL for the user now: in-app browser when the harness has one, otherwise the system opener (macOS `open`, Linux `xdg-open`), otherwise show the URL.\\n\");\n        io.out(&format!(\"Then collect the answer with: {} --wait --key {}\\n\", crate::provider::detect(&env, &cwd).verb_cmd(\"serve-question\"), key));\n        return 0;\n    }\n\n    // ---- server (blocking or detached) ----\n    let raw = match &payload_path {\n        Some(pp) => match std::fs::read(jsp::resolve(&cwd, &[pp])) {\n            Ok(b) => String::from_utf8_lossy(&b).into_owned(),\n            Err(e) => {\n                io.err(&format!(\"Error: {}\\n\", crate::util::node_read_error(pp, &e)));\n                return 1;\n            }","sourceCodeStart":364,"sourceCodeEnd":400,"githubUrl":"https://github.com/pbakaus/impeccable/blob/2bc2879276c1f321a53c4ca99d3371e411329b52/crates/context/src/serve_question.rs#L364-L400","documentation":"The second diagnostic line printed when the serve-question HTTP server fails to start: it reports the (path-relative) log file location and explains that a sandboxed exec that cannot listen on localhost is the canonical cause, advising a rerun through a network-enabled tool before falling back. It is emitted immediately after error 100.","triggerScenarios":"Same as error 100: tiny_http::Server::http fails to bind 127.0.0.1 and the command exits 1 after printing the log path.","commonSituations":"CI/agent sandboxes blocking loopback sockets; the developer or agent then needs the log to diagnose the true bind error.","solutions":["Open the printed log file to see the underlying bind error.","Rerun the command via a network-enabled/unsandboxed exec path.","If a network-enabled run also fails, check for port conflicts on 127.0.0.1.","Use the fallback path instead of serving if local listening is impossible."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// pre-check that loopback listening is permitted\nnode -e \"require('net').createServer().listen(0,'127.0.0.1',function(){console.log('ok');this.close()})\"","typeGuard":null,"tryCatchPattern":"if (result.code === 1 && result.stderr.includes('failed to start')) {\n  retryWithNetworkEnabledTool(result.command);\n}","preventionTips":["Read the referenced log file immediately after failure for root cause.","Avoid sandboxed execs for commands that serve HTTP.","Escalate to unsandboxed exec before trying other workarounds.","Document the harness's network-enabled tool for teammates."],"tags":["server","network","sandbox","cli","logging"],"backgroundTag":"connection-refused","analyzedSha":"2bc2879276c1f321a53c4ca99d3371e411329b52","analyzedAt":"2026-09-08T04:51:14.109Z","contentChangedAt":"2026-09-08T04:51:14.109Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}