Enum IpcErrorCode 

pub enum IpcErrorCode {
    FrameTooLarge,
    MalformedJson,
    SchemaMismatch,
    UnknownMethod,
    PolicyDenied,
    Internal,
    PeerCredentialFailure,
    UnsupportedPlatform,
    BucketNotFound,
    EventNotFound,
    InvalidCursor,
    ShellInterpreterDenied,
    ProgramNotFound,
    ArgvInvalid,
    UnknownJob,
    JobLost,
    RuleNotFound,
    RuleInvalid,
    ScopeInvalid,
    PathDenied,
    FileNotFound,
    FileBinary,
    OversizedRequest,
    UnknownWatch,
    SecretInputDenied,
    UnknownProbe,
    RuleNotActive,
    UnknownSubscription,
    SubscriptionLimitExceeded,
    UnknownSession,
    SessionNotLive,
    SessionLimitExceeded,
    ShuttingDown,
}

Structured error code. Closed set. Adding a variant requires a goal-file amendment.

Variants

FrameTooLarge

Frame exceeded MAX_FRAME_BYTES.

MalformedJson

Payload was not valid UTF-8 JSON.

SchemaMismatch

Payload decoded but didn’t match the wire schema.

UnknownMethod

Method not recognized.

PolicyDenied

Policy engine denied the request.

Internal

Daemon-internal error while handling the request.

PeerCredentialFailure

Peer credential check failed; connection refused.

UnsupportedPlatform

Platform does not support UDS (Windows native).

BucketNotFound

The requested bucket does not exist.

EventNotFound

The requested event id was not found in the bucket.

InvalidCursor

The cursor is invalid (e.g. far above the current tail).

ShellInterpreterDenied

argv[0] basename matches the shell-bridge deny list. command_start_combed is not a shell entry point.

ProgramNotFound

F7: the program named in argv[0] does not exist (the OS spawn returned ErrorKind::NotFound). A CALLER-fixable command attempt (typo / wrong PATH / missing binary), NOT a daemon or transport fault. Surfaced as a structured program_not_found receipt at the MCP boundary (invalid_params, carrying error_kind + argv0) instead of an opaque Internal error so the agent corrects its argv and keeps routing through Terminal Commander. Distinct from every other spawn failure, which stays Internal.

ArgvInvalid

argv shape is invalid (empty, too long, or item too large).

UnknownJob

command_status was called with a job id the daemon does not know.

JobLost

command_status was called with a job id the daemon durably recorded STARTING but never recorded finishing – the daemon died before the terminal transition. Distinct from Self::UnknownJob, which means no durable record exists at all. Never accompanied by a terminal outcome.

Deliberately an error code rather than a lifecycle state: “the daemon lost the thread” is not a job lifecycle state, and an unknown error code fails closed for older clients.

RuleNotFound

registry_get / registry_test / registry_activate / registry_deactivate referenced a (rule_id, version?) the daemon does not know.

RuleInvalid

registry_upsert or registry_test payload failed rule validation (empty id, bad regex, kind/keywords mismatch, etc.).

ScopeInvalid

registry_activate / registry_deactivate was issued with a scope value the daemon cannot resolve to a live entity (unknown bucket / job / probe id) or with a malformed scope payload. The activation is NOT silently widened to Global.

PathDenied

file_* request referenced a path the policy engine rejected (default-deny suffix or future per-profile path policy).

FileNotFound

file_* request referenced a path that does not exist on disk OR is not a regular file (directories rejected here so TC43 does not balloon into directory probe expansion).

FileBinary

file_read_window / file_search detected non-UTF-8 bytes in the requested window. Binary content is rejected with a typed code instead of streaming bytes to the LLM.

OversizedRequest

Request exceeds a bounded cap (line count, byte count, glob breadth, search result count). The dispatcher clamps where safe; payloads that cannot be clamped surface this code.

UnknownWatch

file_watch_stop referenced a watch id the daemon does not know.

SecretInputDenied

pty_command_write_stdin was issued while the target PTY job has an active secret prompt. The LLM input MUST NOT be written. TC44 contract: no automatic password entry, no LLM-supplied password forwarding.

UnknownProbe

probe_status referenced a probe id the daemon does not know across any of its runtimes.

RuleNotActive

registry_activate referenced a rule whose status is not runtime-eligible (Draft / Deprecated / Tombstoned). Activating a non-Active rule would silently bind a definition the sifter runtime then rejects at command-start time with SifterError::NotActive, blocking every newly-started command in scope. The activation is refused up front with the remedy in the message (promote the rule to status=Active and re-upsert) rather than poisoning the scope. See the agent-ergonomics chain.

UnknownSubscription

subscription_pull/subscription_close referenced a sub_id the daemon does not know (unknown or reset by a daemon restart). Caller re-opens. Approved goal-file amendment 2026-06-02.

SubscriptionLimitExceeded

subscription_open exceeded the max-subscriptions cap. Caller frees a slot (subscription_close) and retries. Approved 2026-06-02.

UnknownSession

shell_session_* referenced a session_id the daemon does not know (never started, already reaped, or reset by a daemon restart). P1 / TC50 (omni spec 001).

SessionNotLive

shell_session_exec (or a snapshot apply) targeted a session that is not in the Live state. The terminal-state guard refuses the send loudly instead of hanging on a dead shell. P1 / TC50.

SessionLimitExceeded

shell_session_start was refused because the configured max_sessions cap is already reached. Caller stops a session and retries. P1 / TC50.

ShuttingDown

Returned to a new request that arrives while the daemon is draining for shutdown. Retryable: the client should cold-spawn a fresh daemon.

Trait Implementations

impl Clone for IpcErrorCode

fn clone(&self) -> IpcErrorCode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for IpcErrorCode

impl Debug for IpcErrorCode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IpcErrorCode

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for IpcErrorCode

impl Hash for IpcErrorCode

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for IpcErrorCode

fn eq(&self, other: &IpcErrorCode) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for IpcErrorCode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for IpcErrorCode