abhigyanpatwari/GitNexus · error · ValueError

--ce-plugin-dir and --ce-plugin-version require at least one

Error message

--ce-plugin-dir and --ce-plugin-version require at least one ce_* arm

What it means

validate_ce_plugin_inputs() raises ValueError when --ce-plugin-dir or --ce-plugin-version is supplied but no ce_* arm is in the selected arms list. CE plugin inputs are only meaningful for CE comparator arms, so passing them otherwise is contradictory input the harness refuses to silently ignore.

Source

Thrown at eval/workflow_bench/runtime_mounts.py:265

    except (OSError, json.JSONDecodeError) as exc:
        raise SandboxError(f"pinned GitNexus shared runtime metadata is invalid: {exc}") from exc
    if shared_package.get("name") != "gitnexus-shared":
        raise SandboxError("pinned GitNexus shared runtime has an unexpected package identity")
    return mounts


def validate_ce_plugin_inputs(
    arms: Sequence[str],
    plugin_dir: Path | None,
    plugin_version: str | None,
) -> CePluginConfig | None:
    """Require an explicit directory and exact version iff a CE arm is selected."""

    has_ce_arm = any(arm in CE_ARMS for arm in arms)
    supplied = plugin_dir is not None or plugin_version is not None
    if not has_ce_arm:
        if supplied:
            raise ValueError("--ce-plugin-dir and --ce-plugin-version require at least one ce_* arm")
        return None
    if plugin_dir is None or plugin_version is None:
        raise ValueError("ce_* arms require both --ce-plugin-dir and --ce-plugin-version")
    if _EXACT_VERSION.fullmatch(plugin_version) is None:
        raise ValueError("--ce-plugin-version must be an exact semantic version (aliases and ranges are forbidden)")
    source = _validated_runtime_root(plugin_dir, label="Compound Engineering plugin source")
    return CePluginConfig(source=source, version=plugin_version)


def _is_forbidden_plugin_path(relative: PurePosixPath) -> bool:
    for part in relative.parts:
        lowered = part.lower()
        if lowered in _FORBIDDEN_PATH_PARTS or lowered in _SECRET_EXACT_NAMES:
            return True
        if lowered.startswith(".env.") or lowered.startswith(".npmrc."):
            return True
        if lowered.endswith(_SECRET_SUFFIXES) or any(marker in lowered for marker in _SECRET_NAME_MARKERS):
            return True

View on GitHub (pinned to d540b00184)

Solutions

  1. Add a CE arm to --arms, e.g. `--arms baseline ce_workflow`.
  2. Or remove both --ce-plugin-dir and --ce-plugin-version from the invocation.

Example fix

# before
--arms baseline --ce-plugin-dir ./plugin --ce-plugin-version 1.0.0
# after
--arms baseline ce_workflow --ce-plugin-dir ./plugin --ce-plugin-version 1.0.0
Defensive patterns

Strategy: validation

Validate before calling

from pathlib import Path
from eval.workflow_bench.runtime_mounts import CE_ARMS

def ce_flags_consistent_when_no_ce_arm(arms, plugin_dir, plugin_version) -> bool:
    has_ce_arm = any(a in CE_ARMS for a in arms)
    supplied = plugin_dir is not None or plugin_version is not None
    # OK only when: not has_ce_arm implies not supplied
    return has_ce_arm or not supplied

Try / catch

try:
    cfg = validate_ce_plugin_inputs(arms, plugin_dir, plugin_version)
except ValueError as exc:
    if "require at least one ce_* arm" in str(exc):
        # either add a ce_* arm or drop both flags
        ...
    raise

Prevention

When it happens

Trigger: Invoking the benchmark CLI with `--arms baseline --ce-plugin-dir ./plugin --ce-plugin-version 1.0.0` (no ce_* arm), or calling validate_ce_plugin_inputs(arms=['baseline'], plugin_dir=..., plugin_version=...).

Common situations: Copy-pasted CLI invocation from a CE run into a non-CE run; CI config drift; flags left over from a previous experiment.

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/9b8d9e38b0809dee. Report an issue: GitHub.