chenhg5/cc-connect · error

listen for Agy permission hooks: %w

Error message

listen for Agy permission hooks: %w

What it means

newAgyPermissionBridge sets up a local TCP listener used as a permission-hook bridge for the Antigravity agent. If net.Listen on 127.0.0.1:0 fails, the bridge cannot receive hook callbacks, so construction aborts with this wrapped error. This wraps the underlying OS listen error.

Source

Thrown at agent/antigravity/permission_bridge.go:70

	bridgeCtx, cancel := context.WithCancel(ctx)
	rootDir, err := os.MkdirTemp("", "cc-connect-agy-permission-")
	if err != nil {
		cancel()
		return nil, fmt.Errorf("create permission bridge directory: %w", err)
	}

	configDir, err := createAgyConfigOverlay(rootDir)
	if err != nil {
		cancel()
		_ = os.RemoveAll(rootDir)
		return nil, err
	}

	listener, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		cancel()
		_ = os.RemoveAll(rootDir)
		return nil, fmt.Errorf("listen for Agy permission hooks: %w", err)
	}

	tokenBytes := make([]byte, 32)
	if _, err := rand.Read(tokenBytes); err != nil {
		cancel()
		_ = listener.Close()
		_ = os.RemoveAll(rootDir)
		return nil, fmt.Errorf("generate permission bridge token: %w", err)
	}

	bridge := &agyPermissionBridge{
		ctx:       bridgeCtx,
		cancel:    cancel,
		listener:  listener,
		address:   listener.Addr().String(),
		token:     base64.RawURLEncoding.EncodeToString(tokenBytes),
		rootDir:   rootDir,
		configDir: configDir,

View on GitHub (pinned to 4000b2338a)

Solutions

1. Verify loopback networking is enabled in the environment (check for 'net lo up' / no network namespace isolation) and retry.
2. Check the process file descriptor limit (ulimit -n) and raise it if EMFILE is the wrapped cause.
3. Inspect the wrapped error for errno: EADDRNOTAVAIL/EACCES usually means sandbox/network policy; adjust the sandbox to allow binding 127.0.0.1.
4. Run cc-connect in an environment that permits TCP sockets (disable seccomp/AppArmor restrictions for the agent process).

Example fix

// diagnosing
err := startAgent()
fmt.Println(err) // listen for Agy permission hooks: listen tcp 127.0.0.1:0: bind: ... 
// before (sandbox without loopback)
docker run --network none cc-connect ...
// after
docker run --network bridge cc-connect ...

// Go: probe loopback bindability before starting a session
ln, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil { return fmt.Errorf("loopback unavailable: %w", err) }
ln.Close()

if err := startAntigravitySession(); err != nil {
    var netErr *net.OpError
    if errors.As(err, &netErr) && strings.Contains(err.Error(), "listen for Agy permission hooks") {
        // fall back to an agent without the permission bridge or surface a network-sandbox hint
    }
}

When it happens

Trigger: Calling newAgyPermissionBridge (directly in tests, or via newAntigravitySession when an Antigravity session starts) when no TCP listener can be created on the loopback interface, e.g. loopback networking unavailable or socket file descriptor exhaustion.

Common situations: Containers/sandboxes with networking disabled (network namespace without loopback), rlimits on open file descriptors exhausted (EMFILE), hardened seccomp profiles blocking socket creation, or Windows firewall/AV blocking socket binds.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• antigravity permission bridge: %w
• generate permission bridge token: %w
• resolve home directory for Agy permission bridge: %w
• create Agy permission overlay: %w
• parse existing Agy hooks %s: %w

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/3fbb9275890beff2. Report an issue: GitHub.