[Bug] Network whitelist is missing 'static.rust-lang.org', causing Rustup failures in sandboxed environments

(Using https://chatgpt.com/codex)

1. Summary

The current network domain whitelist for the sandboxed agent environment is incomplete for robust Rust project development. It is missing the domain static.rust-lang.org, which is the primary CDN for Rust toolchain artifacts. This causes any rustup command that needs to download toolchains or components (e.g., rustup update, rustup component add) to fail due to network restrictions.

This directly impacts the reliability of bootstrapping scripts and prevents agents from performing standard Rust environment setup tasks, leading to process failures and incorrect error diagnoses by the agent.

2. The problem in detail

During a recent task execution, an agent's bootstrap script failed. The script was designed to be robust and halt on any error (set -e).

The failure occurred at the rustup update step with the following error:

error: failed to download file error=Reqwest(reqwest::Error { kind: Request, url: "https://static.rust-lang.org/dist/channel-rust-stable.toml.sha256", ... })

This error indicates a network block when trying to connect to static.rust-lang.org.

An analysis of the current network whitelist revealed that while rustup.rs (the installer domain) is present, static.rust-lang.org (the artifact domain) is missing.

3. Motivation & impact

This is not a minor issue; it has several negative consequences:

• Brittle bootstrapping: Standard, well-written bootstrap scripts that ensure a consistent Rust environment will fail, forcing developers to create less-safe workarounds (e.g., ignoring the exit code of rustup update).
• Agent misdiagnosis: As observed, the agent correctly identified the network error but then incorrectly diagnosed the consequence of that error. It assumed the entire bootstrap process was flawed and proceeded with a risky, incomplete setup. A correctly configured environment would have allowed the bootstrap to succeed, preventing this entire class of agent reasoning failure.
• Inability to manage toolchains: Agents are unable to install specific Rust toolchains or add components like rust-wasm on the fly, limiting their ability to work on a wider variety of Rust projects.

By fixing the whitelist, we make the environment more robust, which in turn simplifies agent tasks and improves the reliability of their execution and diagnosis.

4. Proposed solution

The solution is simple and has no known negative side effects.

• Action: Add the domain static.rust-lang.org to the network domain whitelist for the agent execution environment.

This will align the environment's capabilities with the standard operational model of the official Rust toolchain manager, rustup.