abhigyanpatwari/GitNexus · error · ValueError

--ce-plugin-version must be an exact semantic version (alias

Error message

--ce-plugin-version must be an exact semantic version (aliases and ranges are forbidden)

What it means

validate_ce_plugin_inputs() requires --ce-plugin-version to fully match _EXACT_VERSION — a strict semver regex (MAJOR.MINOR.PATCH with optional pre-release/build, no leading comparators). Aliases like `latest` and ranges like `^1.0.0`, `~1`, `>=1.0` are rejected because they make benchmark runs non-reproducible.

Source

Thrown at eval/workflow_bench/runtime_mounts.py:270


def validate_ce_plugin_inputs(
    arms: Sequence[str],
    plugin_dir: Path | None,
    plugin_version: str | None,
) -> CePluginConfig | None:
    """Require an explicit directory and exact version iff a CE arm is selected."""

    has_ce_arm = any(arm in CE_ARMS for arm in arms)
    supplied = plugin_dir is not None or plugin_version is not None
    if not has_ce_arm:
        if supplied:
            raise ValueError("--ce-plugin-dir and --ce-plugin-version require at least one ce_* arm")
        return None
    if plugin_dir is None or plugin_version is None:
        raise ValueError("ce_* arms require both --ce-plugin-dir and --ce-plugin-version")
    if _EXACT_VERSION.fullmatch(plugin_version) is None:
        raise ValueError("--ce-plugin-version must be an exact semantic version (aliases and ranges are forbidden)")
    source = _validated_runtime_root(plugin_dir, label="Compound Engineering plugin source")
    return CePluginConfig(source=source, version=plugin_version)


def _is_forbidden_plugin_path(relative: PurePosixPath) -> bool:
    for part in relative.parts:
        lowered = part.lower()
        if lowered in _FORBIDDEN_PATH_PARTS or lowered in _SECRET_EXACT_NAMES:
            return True
        if lowered.startswith(".env.") or lowered.startswith(".npmrc."):
            return True
        if lowered.endswith(_SECRET_SUFFIXES) or any(marker in lowered for marker in _SECRET_NAME_MARKERS):
            return True
    return False


def _plugin_files(source: Path) -> Iterator[tuple[PurePosixPath, Path]]:
    """Yield only allowlisted plugin files in stable order."""

View on GitHub (pinned to d540b00184)

Solutions

  1. Resolve the range to an exact released version and pin it, e.g. `--ce-plugin-version 1.2.3`.
  2. Pre-release/build metadata are allowed: `1.2.3-beta.1+build.7` matches the regex.

Example fix

# before
--ce-plugin-version "^1.0.0"
# after
--ce-plugin-version "1.0.0"
Defensive patterns

Strategy: validation

Validate before calling

from eval.workflow_bench.runtime_mounts import _EXACT_VERSION

def is_exact_ce_version(v: str | None) -> bool:
    return v is not None and _EXACT_VERSION.fullmatch(v) is not None

Type guard

import re
from eval.workflow_bench.runtime_mounts import _EXACT_VERSION

def is_exact_version(v: str) -> bool:
    """Type/narrowing guard: True only for exact semver (no ranges/aliases)."""
    return bool(_EXACT_VERSION.fullmatch(v))

Try / catch

try:
    cfg = validate_ce_plugin_inputs(arms, plugin_dir, plugin_version)
except ValueError as exc:
    if "exact semantic version" in str(exc):
        # resolve the range to a concrete release and retry
        ...
    raise

Prevention

When it happens

Trigger: Passing `--ce-plugin-version ^1.0.0`, `~1.2`, `>=1.0.0`, `latest`, `*`, or `1.x` to the CLI; or calling validate_ce_plugin_inputs with such a string.

Common situations: Copy-pasting a version range from package.json dependencies; using a dist-tag instead of a release version; CI templating that injects a range.

Understand the failure class

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/94f0398d3609d336. Report an issue: GitHub.