HKUDS/Vibe-Trading · error · ValueError

run_id {run_id!r} must be a bare run directory name

Error message

run_id {run_id!r} must be a bare run directory name

What it means

SwarmStore.run_dir guards against path injection: run_id must be a single safe path segment (no absolute paths, no multiple parts, no '', '.', '..', '/', or '\\'). Violations raise ValueError before the id is joined onto base_dir.

Source

Thrown at agent/src/swarm/store.py:156

        Args:
            run_id: Run identifier.

        Returns:
            Path to the run directory.

        Raises:
            ValueError: If run_id is empty, absolute, or path-shaped.
        """
        candidate = Path(run_id)
        if (
            not run_id.strip()
            or candidate.is_absolute()
            or len(candidate.parts) != 1
            or any(part in {"", ".", ".."} for part in candidate.parts)
            or "/" in run_id
            or "\\" in run_id
        ):
            raise ValueError(f"run_id {run_id!r} must be a bare run directory name")
        return self.base_dir / candidate.name

    def create_run(self, run: SwarmRun) -> Path:
        """Create the directory structure for a new run and write initial state.

        Args:
            run: SwarmRun instance.

        Returns:
            Path to the created run directory.

        Raises:
            FileExistsError: If the run directory already exists.
        """
        rd = self.run_dir(run.id)
        rd.mkdir(parents=True, exist_ok=False)
        (rd / "tasks").mkdir()
        (rd / "inboxes").mkdir()

View on GitHub (pinned to 80ffdda44c)

Solutions

1. Pass only the bare directory name, e.g. '2024-05-01T10-00-00-abc123'
2. Generate ids via the store's create_run instead of constructing them externally
3. Sanitize/validate external run ids before any store call

Example fix

# before
store.run_dir('/var/runs/abc')
# after
store.run_dir('abc')

import re
if not re.fullmatch(r'[A-Za-z0-9._-]+', run_id or '') or run_id in {'.','..'}:
    raise ValueError('unsafe run_id')

def is_bare_run_id(rid) -> bool:
    return (isinstance(rid, str) and rid not in {'','.','..'} and '/' not in rid and '\\' not in rid and len(Path(rid).parts) == 1)

try:
    store.run_dir(run_id)
except ValueError as e:
    if 'bare run directory name' in str(e): reject/sanitize the id
    else: raise

When it happens

Trigger: run_dir('runs/abc'), run_id='/abs/path', run_id containing '..' or a Windows backslash, or an empty run id.

Common situations: Passing a full path or a nested id from user input or logs; reusing a Path object's string form that happens to be absolute.

Related errors

• invalid preset name: {name!r}
• Invalid swarm agent id {agent_id!r}: expected one safe path
• survival_prob must be in (0.0, 1.0], got {survival_prob}
• tenor_years must be strictly positive, got {tenor_years}
• spread_bps must be non-negative, got {spread_bps}

AI-assisted analysis of HKUDS/Vibe-Trading@80ffdda44c (2026-08-28). Data as JSON: /api/errors/1a6b4dc543ca0b6b. Report an issue: GitHub.