{"record":{"id":"b440b96a39195395","repo":"xai-org/grok-build","slug":"hook-write-deny-ensure-failed-e","errorCode":null,"errorMessage":"hook write-deny ensure failed: {e}","messagePattern":"hook write-deny ensure failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-sandbox/src/lib.rs","lineNumber":197,"sourceCode":"        let net_restricted = profile.restricts_network();\n        Self {\n            profile,\n            logger: SandboxLogger::new(),\n            net_restricted,\n            applied: false,\n        }\n    }\n    /// Apply the sandbox to the current process. **Irreversible.**\n    /// Degrades gracefully if the platform doesn't support it.\n    #[cfg(all(feature = \"enforce\", unix))]\n    pub fn apply(&mut self, workspace: &Path) -> anyhow::Result<()> {\n        if self.profile == ProfileName::Off {\n            tracing::info!(\"Sandbox disabled (profile: off)\");\n            return Ok(());\n        }\n        if requires_hook_write_deny(&self.profile, workspace) {\n            xai_grok_config::ensure_grok_hook_slots(paths::grok_home().as_path())\n                .map_err(|e| anyhow::anyhow!(\"hook write-deny ensure failed: {e}\"))?;\n        }\n        hook_write_deny::maybe_install_namespace_lockdown_inside_bwrap(&self.profile, workspace)\n            .map_err(|e| anyhow::anyhow!(\"{e}\"))?;\n        let config = profiles::load_sandbox_config(workspace);\n        let mut resolved = self.profile.resolve_profile(workspace, &config)?;\n        self.net_restricted = resolved.restrict_network;\n        let support = Sandbox::support_info();\n        if !support.is_supported {\n            tracing::warn!(\n                details = %support.details,\n                \"Sandbox not supported on this platform, continuing without sandbox\"\n            );\n            self.logger.log(SandboxEvent::apply_failed(\n                &self.profile.to_string(),\n                workspace,\n                &support.details,\n            ));\n            return Ok(());","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-sandbox/src/lib.rs#L179-L215","documentation":"Raised in `SandboxManager::apply` when `ensure_grok_hook_slots` fails to set up the write-deny hook files under the Grok home directory for profiles that require hook-based write denial. The hook layer is what enforces write denies outside the raw sandbox namespace, so failing to ensure those slots means the sandbox cannot be safely activated and apply aborts.","triggerScenarios":"The profile (per `requires_hook_write_deny`) needs hook write-deny but creating/validating the hook slot files under paths::grok_home() fails — e.g. directory not writable, disk full, an existing hook file with invalid content, or a config-library alias validation error.","commonSituations":"~/.grok owned by root or another user after a sudo run; read-only home or restricted container; stale/corrupt hook JSON left by an older version; XDG config pointing grok home somewhere unwritable.","solutions":["Check the inner `{e}` to see whether it is a filesystem permission or a hook-content validation error.","Ensure ~/.grok (paths::grok_home()) exists and is writable by the current user: `mkdir -p ~/.grok && chown -R $USER ~/.grok`.","Remove or fix stale/invalid hook files under the grok home so ensure can rewrite them.","Re-run the apply command; if running under a container, mount the grok home as writable."],"exampleFix":"# before (fails)\nsudo grok-worktree ...   # creates ~/.grok hook files owned by root\n# after\nsudo chown -R $USER ~/.grok\ngrok-worktree ...        # apply can now ensure hook slots","handlingStrategy":"try-catch","validationCode":"fn grok_home_writable() -> Result<(), String> {\n    let home = xai_grok_sandbox::paths::grok_home();\n    if !home.exists() {\n        std::fs::create_dir_all(&home).map_err(|e| e.to_string())?;\n    }\n    let probe = home.join(\".write-test\");\n    std::fs::write(&probe, b\"ok\").map_err(|e| e.to_string())?;\n    std::fs::remove_file(&probe).map_err(|e| e.to_string())\n}\n// call before manager.apply(...)","typeGuard":null,"tryCatchPattern":"if let Err(e) = manager.apply(workspace) {\n    let msg = e.to_string();\n    if msg.contains(\"hook write-deny ensure failed\") {\n        eprintln!(\"Hook setup failed under {}: fix permissions or stale hook files\\n{e:#}\",\n                  grok_home().display());\n    } else {\n        eprintln!(\"sandbox apply failed: {e:#}\");\n    }\n    std::process::exit(1);\n}","preventionTips":["Never run the tool under sudo in ways that leave ~/.grok root-owned; fix with chown.","Ensure the grok home directory is writable in containers (mount with correct ownership).","Clean stale hook files after upgrading sandbox versions.","Probe writability of grok home at startup with a clear error message."],"tags":["rust","sandbox","filesystem","hooks","permissions"],"backgroundTag":"hook-setup-failed","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}