xai-org/grok-build · error

InvalidInput

InvalidInput

Error message

endpoint has no parent directory

What it means

`materialize_runtime_socket_deny_paths_from` resolves each candidate socket endpoint into a canonical deny path. A `Path` with no parent (a bare relative component like `foo` or `.`) cannot be split into parent + file_name, so the function wraps an `InvalidInput` error, contextualized with the failing candidate path ('could not resolve runtime-socket deny path <candidate>: endpoint has no parent directory').

Source

Thrown at crates/codegen/xai-grok-sandbox/src/runtime_sockets.rs:94

) -> io::Result<Vec<PathBuf>> {
    match handed {
        Ok(encoded) => decode_bwrap_runtime_socket_denies_with_policy(&encoded, allowed),
        Err(std::env::VarError::NotPresent) => Ok(Vec::new()),
        Err(error) => Err(io::Error::new(
            io::ErrorKind::InvalidData,
            format!("invalid bwrap runtime-socket deny handoff: {error}"),
        )),
    }
}

/// Missing candidates are skipped; every other resolution failure is returned.
fn materialize_runtime_socket_deny_paths_from(
    candidates: impl IntoIterator<Item = PathBuf>,
) -> io::Result<Vec<PathBuf>> {
    let mut paths = Vec::new();
    for candidate in candidates {
        let with_context = |error: io::Error| {
            io::Error::new(
                error.kind(),
                format!(
                    "could not resolve runtime-socket deny path {}: {error}",
                    candidate.display()
                ),
            )
        };
        let parent = candidate.parent().ok_or_else(|| {
            with_context(io::Error::new(
                io::ErrorKind::InvalidInput,
                "endpoint has no parent directory",
            ))
        })?;
        let file_name = candidate.file_name().ok_or_else(|| {
            with_context(io::Error::new(
                io::ErrorKind::InvalidInput,
                "endpoint has no file name",
            ))

View on GitHub (pinned to bc7f02eddd)

Solutions

1. Pass absolute endpoints including their directory (e.g. `/run/user/1000/bus`, not `bus`)
2. If you only have a filename, join it with its intended directory before calling
3. Validate candidates with `path.parent().is_some()` and reject/handle bare names up front

Example fix

// before
materialize_runtime_socket_deny_paths(vec![PathBuf::from("bus")])
// after
materialize_runtime_socket_deny_paths(vec![PathBuf::from("/run/user/1000/bus")])

fn ensure_parented(p: &std::path::Path) -> Result<(), String> {
    if p.parent().is_none() {
        return Err(format!("endpoint {} must include a directory", p.display()));
    }
    Ok(())
}

fn has_parent(p: &std::path::Path) -> bool { p.parent().is_some() }

match materialize_runtime_socket_deny_paths(cands) {
    Err(e) if e.kind() == io::ErrorKind::InvalidInput => eprintln!("bad socket endpoint: {e}"),
    other => other,
}

When it happens

Trigger: Passing a relative single-component path (e.g. `sock`, `.`, `..`) — anything where `Path::parent()` returns `None` — into `materialize_runtime_socket_deny_paths` / `materialize_runtime_socket_deny_paths_from` as a runtime-socket endpoint.

Common situations: Hard-coding a socket name without a directory; config with a bare socket filename; a variable that was supposed to hold an absolute path but is empty-ish or a lone `.`/`..` component.

Related errors

• InvalidInput
• no .git file or directory found at {}
• local workspace cwd must exist and be canonicalizable: {}: {
• local workspace cwd must be an existing directory: {}
• {LOCAL_WORKSPACE_HOME_DENIED}

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/b779d2e3f0fa2890. Report an issue: GitHub.