{"record":{"id":"f7e919604f56729b","repo":"xai-org/grok-build","slug":"hook-json-alias-validation-failed-e","errorCode":null,"errorMessage":"hook JSON alias validation failed: {e}","messagePattern":"hook JSON alias validation failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-sandbox/src/profiles.rs","lineNumber":306,"sourceCode":"        for dev in DEVICE_DIRS {\n            let p = Path::new(dev);\n            if p.exists() && p.is_dir() {\n                caps = caps.allow_path(dev, AccessMode::ReadWrite)?;\n            }\n        }\n\n        // Direct global-hook write-deny (macOS Seatbelt; Linux via bwrap).\n        if !profile.write_deny.is_empty() {\n            let mut pairs: Vec<(PathBuf, bool)> = profile\n                .write_deny\n                .iter()\n                .map(|s| (s.path.clone(), s.is_dir()))\n                .collect();\n            #[cfg(unix)]\n            {\n                let files =\n                    xai_grok_config::validated_hook_json_files_for_sources(&profile.write_deny)\n                        .map_err(|e| anyhow::anyhow!(\"hook JSON alias validation failed: {e}\"))?;\n                for f in files {\n                    if !pairs.iter().any(|(p, _)| p == &f) {\n                        pairs.push((f, false));\n                    }\n                }\n            }\n            apply_write_deny_paths_to_capability_set(&mut caps, &pairs, &profile.read_write)?;\n        }\n\n        // Kernel deny (read+write): macOS Seatbelt rules; Linux via bwrap bind-over.\n        // Key on an empty deny set, not profile type, so nothing unintentional is enforced.\n        //\n        // Split exact paths from globs: exact paths keep the literal/subpath flow;\n        // globs become anchored Seatbelt regexes on macOS (a no-op here on Linux,\n        // where they are expanded and bound over at bwrap re-exec).\n        let (exact_deny, glob_deny) = partition_deny_entries(&profile.deny);\n        let all_denied = effective_deny_paths(workspace, &exact_deny);\n        if !all_denied.is_empty() {","sourceCodeStart":288,"sourceCodeEnd":324,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-sandbox/src/profiles.rs#L288-L324","documentation":"`capability_set_from_profile` calls `validated_hook_json_files_for_sources` to resolve and validate hook JSON aliases listed in the profile's write_deny entries (unix only); this error wraps any failure from that validation. It means one of the write_deny entries names a hook JSON alias that cannot be validated or resolved to a concrete file, so the capability set cannot be built.","triggerScenarios":"A write_deny entry references a hook JSON alias that does not exist in the config registry; the referenced JSON file fails schema/content validation; a typo in the alias name in the profile definition.","commonSituations":"Renamed or removed built-in alias after a version upgrade while an old sandbox.toml still references it; custom hook JSON with malformed content; case-sensitivity mistakes in alias names on unix filesystems.","solutions":["Read the inner `{e}` to identify which alias or file failed and why.","Check the write_deny list in your profile (sandbox.toml) for typos in alias names.","Verify the referenced hook JSON file exists and passes schema validation.","Update the alias name if the library renamed built-ins in a newer version.","Remove the invalid alias from write_deny if it is no longer needed."],"exampleFix":"// before (sandbox.toml)\nwrite_deny = [\"secrets-json\", \"credential-deny\"] // 'credential-deny' no longer exists\n// after\nwrite_deny = [\"secrets-json\"]","handlingStrategy":"validation","validationCode":"fn validate_profile_aliases(profile: &SandboxProfile) -> Result<(), String> {\n    xai_grok_config::validated_hook_json_files_for_sources(&profile.write_deny)\n        .map(|_| ())\n        .map_err(|e| format!(\"profile write_deny aliases invalid: {e}\"))\n}\n// call after loading the profile, before building the capability set","typeGuard":null,"tryCatchPattern":"match capability_set_from_profile(profile, workspace) {\n    Ok(cs) => cs,\n    Err(e) if e.to_string().contains(\"hook JSON alias validation failed\") => {\n        eprintln!(\"Bad alias in write_deny: {e:#}\\nCheck sandbox.toml aliases against the built-in registry.\");\n        std::process::exit(2);\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Keep write_deny alias names in sync with the library's built-in registry when upgrading.","Avoid hand-typing alias names; copy them from the documented list.","Validate custom hook JSON against the expected schema before referencing it.","Add a startup check that resolves every alias and fails fast with a clear message."],"tags":["rust","sandbox","hooks","validation","config","unix"],"backgroundTag":"alias-validation-failed","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}