magus v0.3.0 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

MGS2004: sandbox.allow entry failed to resolve

A sandbox.allow entry in magus.yaml (or an equivalent built-in spell allowlist) referenced a path that magus could not resolve.

[MGS2004] sandbox.allow entry failed to resolve; skipped
  path=$NONEXISTENT_VAR/cache

Why

sandbox.allow paths support ~ for the home directory and $VAR references resolved against the current environment. When the expansion yields an empty or invalid path, the entry is skipped (not fatal) and this code is emitted so the user knows the rule did not take effect.

Resolution

  • Check that any $VAR referenced in the path is set in the environment magus runs in.
  • Replace $VAR with an absolute path if the variable does not exist outside a specific shell.
  • Remove the entry if it was a typo.

The path is intentionally skipped rather than failing the run: a missing optional cache should not block a build. If your build then fails for a different reason (e.g. MGS2001 on the same path), you have a clear chain to follow.

sandbox diagnosticsLanding page for the sandbox that confines magus spells to the workspace, plus its MGS2xxx diagnostics for denied reads, writes, execs, and env leaks. MGS2001: path read deniedFires when a spell tries to read a file outside the workspace and outside the configured sandbox allowlist, typically a credential store. MGS2002: path write deniedFires when a spell tries to write to a file outside the workspace and outside the sandbox allowlist, blocking persistence and tampering attacks. magus.yaml configurationEvery magus.yaml config key with its MAGUS_* environment variable, CLI flag, and type. Generated from the config schema.
MGS2004sandboxconfigurationallowlistpath resolutionmagus.yaml
Last updated (b022d75e)
Glossary

Spell

A language/runtime adapter (e.g. go, md) that maps generic targets onto a toolchain's real commands. See spells.

Cache

The content-addressed store magus consults before running a target, so unchanged work is skipped. See cache.

Sandbox

The restricted filesystem and environment a target runs in, so builds stay reproducible and side-effect-free. See sandbox.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs - magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.