abhigyanpatwari/GitNexus · error · ValueError

oracle sanitization retained a repository remote

Error message

oracle sanitization retained a repository remote

What it means

Post-condition: `git remote` must return nothing after the remote-removal loop. Any output means a remote survived `git remote remove`, leaving remote metadata (and possibly fetch refspecs) that could pull oracle-bearing objects back into the clone.

Source

Thrown at eval/workflow_bench/oracle_assets.py:456

        if probe.state != "exited" or probe.returncode not in {1, 128}:
            raise ValueError(f"oracle sanitization could not verify removal of the {label}")

    hidden_listing = _git_checked(
        root,
        ["ls-tree", "-r", "--name-only", "HEAD", "--", HIDDEN_HARNESS_PATH.as_posix()],
        timeout=60,
    )
    if hidden_listing or current.exists() or current.is_symlink():
        raise ValueError("oracle sanitization left the benchmark harness visible")
    if _git_checked(root, ["status", "--porcelain=v1", "--untracked-files=all"], timeout=60):
        raise ValueError("oracle sanitization did not produce a clean task snapshot")
    if _git_checked(root, ["rev-parse", "--verify", "HEAD^{commit}"], timeout=60) != sanitized_head:
        raise ValueError("oracle sanitization did not retain its parentless task snapshot")
    parents = _git_checked(root, ["show", "-s", "--format=%P", "HEAD"], timeout=60)
    if parents:
        raise ValueError("oracle sanitization snapshot unexpectedly retained parent history")
    if _git_checked(root, ["remote"], timeout=60):
        raise ValueError("oracle sanitization retained a repository remote")
    if logs.exists() or logs.is_symlink():
        raise ValueError("oracle sanitization retained reflog metadata")
    return sanitized_head


def _write_stage_file(stage_root: Path, item: OracleFileSnapshot) -> None:
    destination = stage_root.joinpath(*PurePosixPath(item.target).parts)
    destination.parent.mkdir(parents=True, mode=0o700, exist_ok=True)
    current = stage_root
    for part in PurePosixPath(item.target).parts[:-1]:
        current /= part
        metadata = current.lstat()
        if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):
            raise ValueError(f"oracle stage parent must be a real directory: {item.target}")
        current.chmod(0o700)
    descriptor = os.open(
        destination,
        os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0),

View on GitHub (pinned to d540b00184)

Solutions

  1. Inspect: `git -C <clone> remote -v` for survivors.
  2. Remove survivors: `git -C <clone> remote remove <name>`; if that fails, edit .git/config's [remote] sections directly.
  3. Ensure no process re-adds remotes during sanitization; re-clone if needed.
Defensive patterns

Strategy: try-catch

Validate before calling

from pathlib import Path
from eval.workflow_bench.process_control import run_checked

def no_remotes(clone: Path) -> bool:
    return not run_checked(["git","-C",str(clone),"remote"], timeout=60).stdout_tail.strip()

Type guard

def is_remote_retained(exc: BaseException) -> bool:
    return isinstance(exc, ValueError) and "retained a repository remote" in str(exc)

Try / catch

try:
    oracle_assets.sanitize_clone_for_hidden_oracles(clone)
except ValueError as exc:
    quarantine(clone)
    raise AbortTask(str(exc)) from exc

Prevention

When it happens

Trigger: Triggered when `git remote remove <name>` did not fully clear all remotes — typically because .git/config was edited concurrently, a remote name contained characters the porcelain could not match, or a second remote was added between the list and the removal loop.

Common situations: A clone whose .git/config holds remotes with unusual names; concurrent git config edit; a remote re-added by a hook or IDE between enumeration and removal.

Related errors

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/26d5ae52e05f9960. Report an issue: GitHub.