What problem does it solve?
Sandboxed sessions often report false blockers caused by method errors rather than actual policy restrictions, wasting maintainer time on misdirected investigations. This Skill runs a structured diagnostic protocol that eliminates false positives before any blocker report is written.
Core Features & Use Cases
- Eight-step self-diagnosis: Verifies the command actually ran sandboxed, checks binary existence, reads real exit codes instead of pipe results, and detects command-rewriting PreToolUse hooks that break excludedCommands matching.
- Network failure classification: Distinguishes allowlist refusals (5-7 second hangs) from nonexistent hosts (under 30 ms failures) and identifies raw TCP limitations that no domain entry can fix.
- Actionable report template: Produces a literal copy-paste report with exact commands, raw errors, TMPDIR values, and steps already run, ready for whoever holds the settings file.
- Use Case: When pnpm exec fails with EPERM in a sandboxed session, run the protocol to discover a token-compression proxy rewrote the command so the excludedCommands entry no longer matches, then request the prefixed form instead of filing a false blocker.
Quick Start
Ask the assistant to run the sandbox-unblock diagnostic protocol on the failing command before reporting it as a sandbox blocker.
