TrueForge standalone sandbox bootstrap fails to install pydantic due to proxy/package-index connectivity

[Aayushashsahu]

Summary

We are using TrueForge standalone mode and attempting to run a real isolated
sandbox verification for an incident-response workflow.

The TrueForge API itself is healthy and reachable, but sandbox initialization
fails when the sandbox attempts to install:

pydantic>=2.0.0,<3.0.0

The failure appears to be at the proxy/package-index connectivity layer.

Environment

• TrueForge: v0.1.4 standalone
• OS: Ubuntu 26.04 LTS under WSL2
• Python: /usr/bin/python3.14
• TrueForge API: http://localhost:8790
• Public tunnel: https://trueforge.octiqai.com
• Cloudflare tunnel is used only to expose the TrueForge API
• Standalone SQLite storage
• LocalSandboxProvider is being used

The TrueForge API is reachable and /api/v1/models returns HTTP 200.

Reproduction

When TrueForge attempts to create a sandbox, initialization fails while
bootstrapping the sandbox virtual environment:

Failed to pip install pydantic>=2.0.0,<3.0.0 into sandbox .venv

WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None,
status=None)) after connection broken by another exception:

ProxyError('Cannot connect to proxy.',
RemoteDisconnected('Remote end closed connection without response)')

...

ERROR: Could not find a version that satisfies the requirement
pydantic<3.0.0,>=2.0.0 (from versions: none)

ERROR: No matching distribution found for
pydantic<3.0.0,>=2.0.0

[itssaharsh]

Reproduced on a second, independent WSL2 environment — adding details in case they help narrow it down.

Environment

• TrueForge v0.1.4 standalone (npx @truefoundry/trueforge@0.1.4), SQLite storage
• Windows 11 + WSL2, kernel 6.6.87.2-microsoft-standard-WSL2
• Ubuntu 24.04.3 LTS · Python 3.12.3 · Node v22.23.0
• bubblewrap 0.9.0 · socat 1.8.0.0 · rg present — boot log shows Local sandbox fallback is available {"platform":"linux","shell":"/usr/bin/bash","python":"/usr/bin/python3.12"}
• No corporate proxy; host has direct internet access (pip works fine outside the sandbox)

Repro

1. Agent with config.sandbox.enabled: true (no skills needed to trigger it)
2. Any exec tool call → sandbox initialization starts
3. Bootstrap fails while installing pydantic>=2.0.0,<3.0.0 into the sandbox .venv:

Sandbox initialization failed: Failed to pip install pydantic>=2.0.0,<3.0.0 into sandbox .venv:
WARNING: Retrying (...) after connection broken by
'ProxyError('Cannot connect to proxy.', RemoteDisconnected('Remote end closed connection without response'))': /simple/pydantic/

Observations

• While initialization runs, the TrueForge server process is listening on an extra loopback port (the SRT egress proxy — in my case 127.0.0.1:46131), so the proxy listener does exist on the host side; it's pip inside the wrap whose CONNECT to it dies with RemoteDisconnected.
• Possibly relevant asymmetry in packages/trueforge/src/sandbox/local/core/hostRun.ts: darwinSandboxNetworkShellPreamble() rewrites the SRT-injected HTTP_PROXY=...@localhost:PORT to 127.0.0.1 on macOS only. If localhost resolution differs inside bwrap on WSL2 (e.g. resolves to ::1 while the proxy listens on IPv4 loopback only), pip's CONNECT would fail exactly like this. Hypothesis only — I haven't confirmed the in-wrap resolution.

Happy to run diagnostics inside the wrap if it helps (e.g. getent hosts localhost, curl to the injected proxy address) — building on TrueForge for The Agent Harness Hackathon this week, repo: https://github.com/itssaharsh/countersign