abhigyanpatwari/GitNexus · error · ValueError

clone has more than {MAX_CLONE_REFS} references; refusing in

Error message

clone has more than {MAX_CLONE_REFS} references; refusing incomplete sanitization

What it means

After rewriting HEAD to the parentless sanitized commit, the harness enumerates refs with `for-each-ref --count=MAX_CLONE_REFS+1` (MAX_CLONE_REFS=1024). If more than 1024 refs come back, it refuses to delete them in a loop because silent truncation could leave oracle-bearing refs recoverable.

Source

Thrown at eval/workflow_bench/oracle_assets.py:363

            "Sanitized benchmark task snapshot",
        ],
        timeout=60,
        env=deterministic_git_env,
    )
    _git_checked(
        root,
        ["update-ref", "--no-deref", "HEAD", sanitized_head, original_head],
        timeout=60,
    )

    refs_output = _git_checked(
        root,
        ["for-each-ref", f"--count={MAX_CLONE_REFS + 1}", "--format=%(refname)"],
        timeout=60,
    )
    refs = refs_output.splitlines() if refs_output else []
    if len(refs) > MAX_CLONE_REFS:
        raise ValueError(f"clone has more than {MAX_CLONE_REFS} references; refusing incomplete sanitization")
    if any(not ref.startswith("refs/") or any(character.isspace() for character in ref) for ref in refs):
        raise ValueError("clone contains an unsafe reference name")
    for ref in refs:
        _git_checked(root, ["update-ref", "--no-deref", "-d", ref], timeout=60)

    remote_output = _git_checked(root, ["remote"], timeout=60)
    remotes = remote_output.splitlines() if remote_output else []
    if len(remotes) > MAX_CLONE_REFS or any(
        re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._/-]{0,255}", remote) is None or ".." in remote for remote in remotes
    ):
        raise ValueError("clone contains unsafe or unbounded remote metadata")
    for remote in remotes:
        _git_checked(root, ["remote", "remove", remote], timeout=60)

    _git_checked(
        root,
        ["reflog", "expire", "--expire=now", "--expire-unreachable=now", "--all"],
        timeout=60,

View on GitHub (pinned to d540b00184)

Solutions

  1. Clone with a single branch and no tags: `git clone --single-branch --no-tags <url>`.
  2. Drop the origin remote before sanitizing so origin/* refs disappear: `git -C <clone> remote remove origin`.
  3. Prune refs you do not need: `git -C <clone> for-each-ref --format='%(refname)' | xargs -n1 git -C <clone> update-ref -d`.

Example fix

// before
 git clone --mirror <url> <clone>
// after
 git clone --single-branch --no-tags <url> <clone>
Defensive patterns

Strategy: validation

Validate before calling

from pathlib import Path
from eval.workflow_bench.oracle_assets import MAX_CLONE_REFS
from eval.workflow_bench.process_control import run_checked

def ref_count_within_bound(clone: Path) -> bool:
    out = run_checked(
        ["git", "-C", str(clone), "for-each-ref", f"--count={MAX_CLONE_REFS+1}", "--format=%(refname)"],
        timeout=60,
    ).stdout_tail.strip()
    return len(out.splitlines()) <= MAX_CLONE_REFS

Type guard

def is_too_many_refs(exc: BaseException) -> bool:
    return isinstance(exc, ValueError) and "more than" in str(exc) and "references" in str(exc)

Try / catch

try:
    oracle_assets.sanitize_clone_for_hidden_oracles(clone)
except ValueError as exc:
    quarantine(clone)
    raise AbortTask(str(exc)) from exc

Prevention

When it happens

Trigger: Triggered when the clone has more than 1024 refs (a mirror clone, a fetch that pulled every PR ref, or a repo with extensive tag/branch history).

Common situations: `git clone --mirror`; CI clones that fetch all refs/*; large monorepos with thousands of tags; fetching refs/pull/* from GitHub.

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/b81dbdac4a64dc26. Report an issue: GitHub.