{"record":{"id":"d1b3bbd1812f8cd5","repo":"chenhg5/cc-connect","slug":"generate-permission-bridge-token-w","errorCode":null,"errorMessage":"generate permission bridge token: %w","messagePattern":"generate permission bridge token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agent/antigravity/permission_bridge.go","lineNumber":78,"sourceCode":"\tif err != nil {\n\t\tcancel()\n\t\t_ = os.RemoveAll(rootDir)\n\t\treturn nil, err\n\t}\n\n\tlistener, err := net.Listen(\"tcp\", \"127.0.0.1:0\")\n\tif err != nil {\n\t\tcancel()\n\t\t_ = os.RemoveAll(rootDir)\n\t\treturn nil, fmt.Errorf(\"listen for Agy permission hooks: %w\", err)\n\t}\n\n\ttokenBytes := make([]byte, 32)\n\tif _, err := rand.Read(tokenBytes); err != nil {\n\t\tcancel()\n\t\t_ = listener.Close()\n\t\t_ = os.RemoveAll(rootDir)\n\t\treturn nil, fmt.Errorf(\"generate permission bridge token: %w\", err)\n\t}\n\n\tbridge := &agyPermissionBridge{\n\t\tctx:       bridgeCtx,\n\t\tcancel:    cancel,\n\t\tlistener:  listener,\n\t\taddress:   listener.Addr().String(),\n\t\ttoken:     base64.RawURLEncoding.EncodeToString(tokenBytes),\n\t\trootDir:   rootDir,\n\t\tconfigDir: configDir,\n\t\tevents:    events,\n\t\tpending:   make(map[string]chan core.PermissionResult),\n\t}\n\tbridge.wg.Add(1)\n\tgo bridge.acceptLoop()\n\treturn bridge, nil\n}\n","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/agent/antigravity/permission_bridge.go#L60-L96","documentation":"After creating the listener, newAgyPermissionBridge generates a 32-byte random token used to authenticate hook requests. If crypto/rand.Read fails, the bridge cannot be secured, so construction aborts with this wrapped error.","triggerScenarios":"newAgyPermissionBridge called (via newAntigravitySession or tests) when crypto/rand.Read cannot read from the OS entropy source.","commonSituations":"Extremely rare on Linux/macOS; seen when /dev/urandom is unavailable or blocked by a hardened container/sandbox, or on systems with a broken crypto/rand backend.","solutions":["Ensure the runtime environment exposes the OS entropy source (/dev/urandom on Linux) and is not blocked by the sandbox.","Retry the operation — crypto/rand failures are almost always transient environment issues.","Check the wrapped error's underlying cause (errno) to identify the entropy-source failure.","If running inside a minimal container, use a base image that mounts /dev/urandom properly."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Go: verify crypto/rand availability\nif _, err := rand.Read(make([]byte, 32)); err != nil {\n    return fmt.Errorf(\"entropy source unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := startAntigravitySession(); err != nil && strings.Contains(err.Error(), \"generate permission bridge token\") {\n    // check /dev/urandom availability, retry once before failing hard\n}","preventionTips":["Use container images that expose /dev/urandom.","Avoid sandboxes that block getrandom(2)/urandom reads.","Treat entropy failures as environment faults and add a single retry."],"tags":["crypto","random","antigravity","go"],"backgroundTag":"missing-env-var","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}