---
title: "MGS2004: sandbox.allow unresolved"
description: Fires when a sandbox.allow path in magus.yaml references an env var or path that magus cannot resolve, so the rule is skipped rather than fatal.
tags: [MGS2004, sandbox, configuration, allowlist, path resolution, magus.yaml]
---

# MGS2004: sandbox.allow entry failed to resolve

A `sandbox.allow` entry in `magus.yaml` (or an equivalent built-in
spell allowlist) referenced a path that magus could not resolve.

```text
[MGS2004] sandbox.allow entry failed to resolve; skipped
  path=$NONEXISTENT_VAR/cache
```

## Why

`sandbox.allow` paths support `~` for the home directory and `$VAR`
references resolved against the current environment. When the expansion
yields an empty or invalid path, the entry is skipped (not fatal) and
this code is emitted so the user knows the rule did not take effect.

## Resolution

- Check that any `$VAR` referenced in the path is set in the
  environment magus runs in.
- Replace `$VAR` with an absolute path if the variable does not exist
  outside a specific shell.
- Remove the entry if it was a typo.

The path is intentionally skipped rather than failing the run: a
missing optional cache should not block a build. If your build then
fails for a different reason (e.g. MGS2001 on the same path), you have
a clear chain to follow.