serve-question: log at {}. A sandboxed exec that cannot list

Error message

serve-question: log at {}. A sandboxed exec that cannot listen on localhost causes exactly this; rerun this command once through the harness's network-enabled or unsandboxed command tool before falling back.

What it means

The second diagnostic line printed when the serve-question HTTP server fails to start: it reports the (path-relative) log file location and explains that a sandboxed exec that cannot listen on localhost is the canonical cause, advising a rerun through a network-enabled tool before falling back. It is emitted immediately after error 100.

Source

Thrown at crates/context/src/serve_question.rs:382

            impeccable_common::proc::detach(&mut cmd);
            cmd.spawn()
        };
        let _ = spawned; // detached: never waited on
        let deadline = now_ms() + 8000.0;
        while now_ms() < deadline && !exists(&state_file(&qdir, &key)) {
            sleep_ms(100);
        }
        if !exists(&state_file(&qdir, &key)) {
            let tail = safe_read(&log_file)
                .map(|t| {
                    let lines: Vec<&str> = crate::util::js_trim(&t).split('\n').collect();
                    let n = lines.len();
                    lines[n.saturating_sub(4)..].join("\n  ")
                })
                .unwrap_or_default();
            io.err(&format!("serve-question: server failed to start{}\n", if tail.is_empty() { String::new() } else { format!("\n  {}", tail) }));
            let rel = jsp::relative(&cwd, &cwd, &log_file);
            io.err(&format!("serve-question: log at {}. A sandboxed exec that cannot listen on localhost causes exactly this; rerun this command once through the harness's network-enabled or unsandboxed command tool before falling back.\n", if rel.is_empty() { log_file.clone() } else { rel }));
            return 1;
        }
        let state = read_state(&qdir, &key).unwrap_or_default();
        io.out(&format!("QUESTION URL: {}\n", state.get("url").map(js_str).unwrap_or_default()));
        io.out(&format!("QUESTION KEY: {}\n", key));
        io.out("Open the URL for the user now: in-app browser when the harness has one, otherwise the system opener (macOS `open`, Linux `xdg-open`), otherwise show the URL.\n");
        io.out(&format!("Then collect the answer with: {} --wait --key {}\n", crate::provider::detect(&env, &cwd).verb_cmd("serve-question"), key));
        return 0;
    }

    // ---- server (blocking or detached) ----
    let raw = match &payload_path {
        Some(pp) => match std::fs::read(jsp::resolve(&cwd, &[pp])) {
            Ok(b) => String::from_utf8_lossy(&b).into_owned(),
            Err(e) => {
                io.err(&format!("Error: {}\n", crate::util::node_read_error(pp, &e)));
                return 1;
            }

View on GitHub (pinned to 2bc2879276)

Solutions

Open the printed log file to see the underlying bind error.
Rerun the command via a network-enabled/unsandboxed exec path.
If a network-enabled run also fails, check for port conflicts on 127.0.0.1.
Use the fallback path instead of serving if local listening is impossible.

Defensive patterns

Strategy: fallback

Validate before calling

// pre-check that loopback listening is permitted
node -e "require('net').createServer().listen(0,'127.0.0.1',function(){console.log('ok');this.close()})"

Try / catch

if (result.code === 1 && result.stderr.includes('failed to start')) {
  retryWithNetworkEnabledTool(result.command);
}

Prevention

Read the referenced log file immediately after failure for root cause.
Avoid sandboxed execs for commands that serve HTTP.
Escalate to unsandboxed exec before trying other workarounds.
Document the harness's network-enabled tool for teammates.

When it happens

Trigger: Same as error 100: tiny_http::Server::http fails to bind 127.0.0.1 and the command exits 1 after printing the log path.

Common situations: CI/agent sandboxes blocking loopback sockets; the developer or agent then needs the log to diagnose the true bind error.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of pbakaus/impeccable@2bc2879276 (2026-09-08). Data as JSON: /api/errors/84b7b06f13998065. Report an issue: GitHub.