multica-ai/multica · error

read config.toml: %w

Error message

read config.toml: %w

What it means

ensureCodexSandboxConfig reads the task's config.toml before upserting the managed sandbox block. A missing file is fine (it is created), but any other read error — permissions, I/O failure, or the path being a directory — aborts sandbox configuration so an unmanaged config is never silently accepted.

Source

Thrown at server/internal/daemon/execenv/codex_sandbox.go:443

		}
		out = append(out, line)
	}
	return strings.Join(out, "\n")
}

// ensureCodexSandboxConfig writes the multica-managed sandbox block into the
// given config.toml according to the policy. It is idempotent: running it
// twice produces the same file contents. The file is created if it doesn't
// exist.
//
// The function logs (at warn level) whenever the resolved mode is
// danger-full-access — the Linux default, the macOS seatbelt fallback, and the
// Windows no-native-sandbox fallback alike — so that every unsandboxed task is
// visible in daemon logs.
func ensureCodexSandboxConfig(configPath string, policy codexSandboxPolicy, detectedVersion string, logger *slog.Logger) error {
	data, err := os.ReadFile(configPath)
	if err != nil && !os.IsNotExist(err) {
		return fmt.Errorf("read config.toml: %w", err)
	}
	existing := string(data)

	// Drop inline sandbox_mode / [sandbox_workspace_write] from older daemon
	// versions so they don't collide with the managed block.
	if existing != "" && !managedBlockRe.MatchString(existing) {
		existing = stripLegacySandboxDirectives(existing)
	}

	updated := upsertMulticaManagedBlock(existing, policy)
	if updated == string(data) {
		return nil
	}

	if policy.Mode == "danger-full-access" && logger != nil {
		version := detectedVersion
		if version == "" {
			version = "unknown"

View on GitHub (pinned to 2c0912b6ec)

Solutions

1. Fix ownership/permissions on the task home's config.toml
2. Delete the unreadable config.toml — it will be recreated with the managed block
3. Recreate the task home if state is suspect

if fi, err := os.Stat(configPath); err == nil && !fi.Mode().IsRegular() {
	return fmt.Errorf("config.toml path is not a regular file")
}

if err := ensureCodexSandboxConfig(...); err != nil {
	if strings.Contains(err.Error(), "read config.toml") && !errors.Is(err, fs.ErrPermission) {
		// missing file is fine; anything else needs operator attention
	}
}

When it happens

Trigger: config.toml exists but is unreadable by the daemon user; the path names a directory; disk I/O error during read.

Common situations: Task home restored from archive with wrong ownership; a task made config.toml mode 000; corrupted volume.

Related errors

• write config.toml: %w
• open %s %s: %w
• Invalid desktop runtime config: ${field} must be a valid URL
• mint PAT: target API URL not set
• resolve workspaces_root: %w

AI-assisted analysis of multica-ai/multica@2c0912b6ec (2026-08-15). Data as JSON: /api/errors/6c290e2ac2208391. Report an issue: GitHub.