abhigyanpatwari/GitNexus · error · SandboxError

{label} must be a real directory: {root}

Error message

{label} must be a real directory: {root}

What it means

Raised by _validated_runtime_root (runtime_mounts.py:145-146) when the path exists but is not acceptable: it is a symlink (S_ISLNK), not a directory (not S_ISDIR), or resolve(strict=True) differs from the absolute path — i.e. some component of the path is a symlink. The harness refuses symlink hops to keep the pinned runtime immutable and unspoofable.

Source

Thrown at eval/workflow_bench/runtime_mounts.py:146

def ce_plugin_dir_for_arm(arm: str, snapshot: CePluginSnapshot | None) -> str | None:
    """Return Claude's fixed in-sandbox plugin path only for CE arms."""

    ce_plugin_mounts_for_arm(arm, snapshot)
    return SANDBOX_CE_PLUGIN if arm in CE_ARMS else None


def _validated_runtime_root(path: Path, *, label: str) -> Path:
    """Return one real directory without accepting any symlink hop."""

    root = path.expanduser().absolute()
    try:
        mode = root.lstat().st_mode
        resolved = root.resolve(strict=True)
    except OSError as exc:
        raise SandboxError(f"{label} is unavailable: {root}: {exc}") from exc
    if stat.S_ISLNK(mode) or not stat.S_ISDIR(mode) or resolved != root:
        raise SandboxError(f"{label} must be a real directory: {root}")
    return root


def _validated_runtime_component(
    root: Path,
    relative: str,
    target: str,
    *,
    directory: bool,
) -> ReadOnlyMount:
    """Validate one direct runtime component before exposing only that path."""

    source = root / relative
    try:
        mode = source.lstat().st_mode
        resolved = source.resolve(strict=True)
    except OSError as exc:
        raise SandboxError(f"pinned GitNexus runtime component is unavailable: {source}: {exc}") from exc

View on GitHub (pinned to d540b00184)

Solutions

1. Replace the symlink with the real directory (move the target into place).
2. Ensure no path component is a symlink — use `realpath <path>` and compare to the requested path.
3. Point the harness at the resolved real directory directly.

from pathlib import Path
p = Path(path).expanduser().absolute()
if p.is_symlink() or not p.is_dir() or p.resolve(strict=True) != p:
    raise SystemExit(f"{label} must be a real directory (no symlinks): {p}")

import stat
from pathlib import Path
def is_real_directory(path: str) -> bool:
    p = Path(path).expanduser().absolute()
    try:
        mode = p.lstat().st_mode
        return not stat.S_ISLNK(mode) and stat.S_ISDIR(mode) and p.resolve(strict=True) == p
    except OSError:
        return False

When it happens

Trigger: gitnexus is a symlink to elsewhere; the path is a regular file where a directory is expected; an intermediate path component is a symlink so resolved != absolute; a deployment that symlinks the runtime into place.

Common situations: Dev setups that symlink gitnexus to a shared location; Docker volumes that surface as symlinks; a file (e.g. dist) where a dir is required.

Related errors

• evidence source must be a regular non-symlink file: {path}
• results directory must not traverse symlinks: {root}
• results artifact parent must be a real directory: {current}
• pinned GitNexus runtime component must be a real {kind}: {so
• {label} must be a real non-symlink directory: {path}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/196b33af460e3929. Report an issue: GitHub.