slimtoolkit/slim · error

ambiguous start command: cannot use [app_name,app_args] and

Error message

ambiguous start command: cannot use [app_name,app_args] and [app_entrypoint,app_cmd] simultaneously

What it means

This error is raised in readCommandFile (called by NewStandalone) when a start command specifies the [app_name, app_args] style and the [app_entrypoint, app_cmd] style at the same time. The two forms are mutually exclusive ways to describe the target process, so the parser refuses to guess and converts ENTRYPOINT+CMD into AppName+AppArgs only when no AppName/AppArgs are present.

Source

Thrown at pkg/app/sensor/execution/standalone.go:142

	// of the standalone mode, the need for supporting Docker's original
	// CMD[] + ENTRYPOINT[] approach arose. However, to keep things simple:
	//
	//  - These two "modes" of starting the target app will be mutually exclusive
	//    (from the sensor's users standpoint).
	//  - The CMD + ENTRYPOINT mode will be converted back to the AppName + AppArgs
	//    early on in the sensor's processing (to prevent cascading changes).

	// First, check if there is a run-time override of the CMD[] part
	// (i.e., anything after the `--` separator).
	// If there is some, it'll essentially "activate" the CMD + ENTRYPOINT mode.
	if args := flag.Args(); len(args) > 0 {
		cmd.AppCmd = args
	}

	// If it's ENTRYPOINT + CMD mode, converting back to AppName + AppArgs.
	if len(cmd.AppEntrypoint)+len(cmd.AppCmd) > 0 {
		if len(cmd.AppName)+len(cmd.AppArgs) > 0 {
			return cmd, errors.New("ambiguous start command: cannot use [app_name,app_args] and [app_entrypoint,app_cmd] simultaneously")
		}

		if len(cmd.AppEntrypoint) > 0 {
			cmd.AppName = cmd.AppEntrypoint[0]
			cmd.AppArgs = append(cmd.AppEntrypoint[1:], cmd.AppCmd...)
		} else {
			cmd.AppName = cmd.AppCmd[0]
			cmd.AppArgs = cmd.AppCmd[1:]
		}
	}

	return cmd, nil
}

View on GitHub (pinned to 81940d17fa)

Solutions

1. Remove either the app_name/app_args fields or the app_entrypoint/app_cmd fields from the command file
2. Prefer app_entrypoint+app_cmd if you want Dockerfile-like semantics (first entrypoint element becomes app name)
3. Prefer app_name+app_args for a single explicit executable
4. Regenerate the command file with the slim tooling rather than hand-editing

Example fix

// before (command file)
{"app_name": "myapp", "app_args": ["-v"], "app_entrypoint": "/usr/bin/myapp", "app_cmd": ["-v"]}
// after
{"app_entrypoint": "/usr/bin/myapp", "app_cmd": ["-v"]}

// Go: ensure the two start-command forms are not both set
func hasBothForms(cmd StartCommand) bool {
    return (cmd.AppName != "" || len(cmd.AppArgs) > 0) &&
           (len(cmd.AppEntrypoint) > 0 || len(cmd.AppCmd) > 0)
}

When it happens

Trigger: Providing both app_name/app_args and app_entrypoint/app_cmd keys in the command file passed to NewStandalone; e.g., a generated command file that accumulated fields from two different configuration paths.

Common situations: Migrating configs from ENTRYPOINT+CMD style to APPNAME style without removing old keys; tooling that always serializes both fields; hand-edited command JSON with leftover keys.

Related errors

• unknown sensor mode
• sensor shutdown before monitor stop
• run sensor without monitor failed: %w
• run sensor with monitor failed: %w
• failed to prepare artifacts env: %w

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/7e03763dc83a4cb6. Report an issue: GitHub.