Repository navigation
adopt msb structured policy-denial responses and update diagnostics #623
Description
Context
MSB 0.7.9 introduces default JSON HTTP 403 policy-denial responses (superradcompany/microsandbox#1825). ACQ currently pins 0.7.7. Multiple users want actionable denial diagnostics instead of opaque connection failures. The latest release observed during investigation is 0.7.10; select and validate an exact target before updating the pin.
A host diagnostic on MSB 0.7.7 observed curl TLS EOF/status 000 and npm ECONNRESET from a seed configured with hostname-only allow rules without TLS interception. This configuration is incompatible with strict authority checking; an upgrade improves observability but does not authorize the request or replace correct interception/upstream CA configuration.
Work
- Review 0.7.8 through the selected release for runtime/state/schema compatibility and available checksummed release bundles.
- Update installer/backend pins and dependent tests/docs/package-manager consumers consistently after approval.
- Inspect ACQ HTTP-status consumers: supported proxy policy denials must not be mistaken for an expired USAi key or an upstream application 403. Parse bounded structured error codes safely without logging secrets or raw response bodies.
- Preserve response-status checking: curl exit zero alone does not establish HTTP success.
- Validate allowed and denied HTTPS requests, supported secret-policy denials, existing configuration behavior, and sandbox restart/runtime version behavior on a real host.
- Record exact verification and rollback constraints before rollout.
Acceptance
Users receive an actionable policy-denial diagnostic for supported HTTP paths, while normal upstream authorization failures remain distinguishable. No TLS verification or network enforcement is weakened. Upstream notes limit the response behavior to supported safely answerable HTTP requests; do not promise JSON for every transport failure.
AI-assisted tracking item created from the host startup/cache investigation. No upgrade performed yet.
Activity