{"record":{"id":"d67c8e96f3ea0e71","repo":"astrid-runtime/astrid","slug":"invalid-egress-entry-entry-e","errorCode":null,"errorMessage":"invalid --egress entry {entry:?}: {e}","messagePattern":"invalid --egress entry (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/agent/mod.rs","lineNumber":440,"sourceCode":"    if let Some(n) = args.processes {\n        updates.push(QuotaField::Processes(n));\n    }\n    Ok(updates)\n}\n\n/// Translate `--egress` / `--process-allow` allow-lists into Layer 6\n/// capability patterns and validate each against the capability\n/// grammar (no dots in segments, etc.). Catching invalid labels here\n/// — before any IPC — prevents the kernel from accepting the agent\n/// profile and then rejecting the follow-up grant, which would leave a\n/// half-provisioned agent on disk.\nfn build_caps_to_grant(args: &CreateArgs) -> Result<Vec<String>> {\n    let mut caps: Vec<String> = Vec::new();\n    if let Some(domains) = args.egress.as_deref() {\n        for entry in domains.split(',').map(str::trim).filter(|s| !s.is_empty()) {\n            let cap = format!(\"network:egress:{entry}\");\n            astrid_core::capability_grammar::validate_capability(&cap)\n                .map_err(|e| anyhow::anyhow!(\"invalid --egress entry {entry:?}: {e}\"))?;\n            caps.push(cap);\n        }\n    }\n    if let Some(cmds) = args.process_allow.as_deref() {\n        for entry in cmds.split(',').map(str::trim).filter(|s| !s.is_empty()) {\n            let cap = format!(\"process:spawn:{entry}\");\n            astrid_core::capability_grammar::validate_capability(&cap)\n                .map_err(|e| anyhow::anyhow!(\"invalid --process-allow entry {entry:?}: {e}\"))?;\n            caps.push(cap);\n        }\n    }\n    Ok(caps)\n}\n\n/// Apply the parsed quota deltas: `QuotaGet` to pull the new agent's\n/// defaults, replay each requested field, single `QuotaSet`. A failure\n/// here leaves the agent in place with default quotas — operator can\n/// re-run `astrid quota set -a <name> ...` to retry.","sourceCodeStart":422,"sourceCodeEnd":458,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/agent/mod.rs#L422-L458","documentation":"Raised in build_caps_to_grant when a single --egress entry cannot be validated by astrid_core::capability_grammar::validate_capability after being formatted as 'network:egress:{entry}'. The grammar validator rejects entries that do not form a syntactically valid egress capability token.","triggerScenarios":"Calling run_create with --egress containing an entry that produces an invalid capability string, e.g. empty after comma-splitting is filtered (rare), entries with illegal characters, spaces, wildcards, or a malformed domain/port specification.","commonSituations":"Typing a domain with a trailing comma issue, including spaces inside an entry ('example .com'), using shell-glob wildcards where the grammar forbids them, or pasting a full capability string when only the egress target is expected.","solutions":["Fix the offending --egress entry so it matches the capability grammar (valid domain/host form)","Check the error suffix from validate_capability, which names the exact grammar violation","Split multiple targets with commas and trim whitespace; quote the argument in the shell"],"exampleFix":"// before\n--egress 'example .com,api.example.org'\n// after\n--egress 'example.com,api.example.org'","handlingStrategy":"validation","validationCode":"let cap = format!(\"network:egress:{entry}\");\nif astrid_core::capability_grammar::validate_capability(&cap).is_err() { eprintln!(\"invalid egress entry: {entry}\"); std::process::exit(2); }","typeGuard":"fn valid_egress(entry: &str) -> bool { astrid_core::capability_grammar::validate_capability(&format!(\"network:egress:{entry}\")).is_ok() }","tryCatchPattern":"match build_caps_to_grant(&args) { Ok(caps) => caps, Err(e) => { eprintln!(\"{e:#}\"); std::process::exit(2); } }","preventionTips":["Keep each comma-separated egress entry to a bare host/domain form","Trim whitespace and avoid stray characters when composing --egress","Test new capability strings against validate_capability in a unit test"],"tags":["cli","validation","capability-grammar"],"backgroundTag":"invalid-argument-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}