chenhg5/cc-connect · error

generate permission bridge token: %w

Error message

generate permission bridge token: %w

What it means

After creating the listener, newAgyPermissionBridge generates a 32-byte random token used to authenticate hook requests. If crypto/rand.Read fails, the bridge cannot be secured, so construction aborts with this wrapped error.

Source

Thrown at agent/antigravity/permission_bridge.go:78

	if err != nil {
		cancel()
		_ = os.RemoveAll(rootDir)
		return nil, err
	}

	listener, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		cancel()
		_ = os.RemoveAll(rootDir)
		return nil, fmt.Errorf("listen for Agy permission hooks: %w", err)
	}

	tokenBytes := make([]byte, 32)
	if _, err := rand.Read(tokenBytes); err != nil {
		cancel()
		_ = listener.Close()
		_ = os.RemoveAll(rootDir)
		return nil, fmt.Errorf("generate permission bridge token: %w", err)
	}

	bridge := &agyPermissionBridge{
		ctx:       bridgeCtx,
		cancel:    cancel,
		listener:  listener,
		address:   listener.Addr().String(),
		token:     base64.RawURLEncoding.EncodeToString(tokenBytes),
		rootDir:   rootDir,
		configDir: configDir,
		events:    events,
		pending:   make(map[string]chan core.PermissionResult),
	}
	bridge.wg.Add(1)
	go bridge.acceptLoop()
	return bridge, nil
}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Ensure the runtime environment exposes the OS entropy source (/dev/urandom on Linux) and is not blocked by the sandbox.
2. Retry the operation — crypto/rand failures are almost always transient environment issues.
3. Check the wrapped error's underlying cause (errno) to identify the entropy-source failure.
4. If running inside a minimal container, use a base image that mounts /dev/urandom properly.

// Go: verify crypto/rand availability
if _, err := rand.Read(make([]byte, 32)); err != nil {
    return fmt.Errorf("entropy source unavailable: %w", err)
}

if err := startAntigravitySession(); err != nil && strings.Contains(err.Error(), "generate permission bridge token") {
    // check /dev/urandom availability, retry once before failing hard
}

When it happens

Trigger: newAgyPermissionBridge called (via newAntigravitySession or tests) when crypto/rand.Read cannot read from the OS entropy source.

Common situations: Extremely rare on Linux/macOS; seen when /dev/urandom is unavailable or blocked by a hardened container/sandbox, or on systems with a broken crypto/rand backend.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• listen for Agy permission hooks: %w
• resolve home directory for Agy permission bridge: %w
• create Agy permission overlay: %w
• parse existing Agy hooks %s: %w
• read existing Agy hooks %s: %w

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/d1b3bbd1812f8cd5. Report an issue: GitHub.