abhigyanpatwari/GitNexus · error · Error

Refusing unsafe auto-sync clone root under ${dangerousRoot}:

Error message

Refusing unsafe auto-sync clone root under ${dangerousRoot}: ${root}

What it means

Thrown by assertNotDangerousRoot (via resolveConfiguredCloneRoot) when the resolved clone root is not itself blocklisted but path.relative() shows it is nested inside a DANGEROUS_PARENT_ROOT — a parent directory whose contents must not be mixed with cloned repositories (system directories, other tools' managed roots). The guard rejects any root that would be contained by, rather than equal to, a dangerous directory.

Source

Thrown at gitnexus/src/core/auto-sync/path-security.ts:217

        // The timestamp is the leading fixed-width field, so a descending
        // string sort is newest-first.
        .sort((a, b) => (a < b ? 1 : a > b ? -1 : 0))
        .slice(QUARANTINE_MAX_ENTRIES_PER_REPO)
        .map(async (entry) => {
          await fs.rm(path.join(quarantineRoot, entry), { recursive: true, force: true });
          await fs.rm(path.join(quarantineRoot, `${entry}.README.txt`), { force: true });
        }),
    ),
  );
}

function assertNotDangerousRoot(root: string): void {
  if (root === path.resolve(getGlobalDir(), 'repos')) return;
  if (DANGEROUS_ROOTS.has(root)) throw new Error(`Refusing unsafe auto-sync clone root: ${root}`);
  for (const dangerousRoot of DANGEROUS_PARENT_ROOTS) {
    const rel = path.relative(dangerousRoot, root);
    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) {
      throw new Error(`Refusing unsafe auto-sync clone root under ${dangerousRoot}: ${root}`);
    }
  }
  if (path.parse(root).root === root)
    throw new Error(`Refusing filesystem root as clone root: ${root}`);
}

function assertNotGitNexusInternalRoot(root: string): void {
  const gitnexusDir = path.resolve(getGlobalDir());
  const blocked = [
    path.join(gitnexusDir, 'groups'),
    path.join(gitnexusDir, 'indexes'),
    path.join(gitnexusDir, 'quarantine'),
    path.join(getAutoSyncWatchDir(gitnexusDir), 'quarantine'),
  ];
  for (const blockedRoot of blocked) {
    const rel = path.relative(blockedRoot, root);
    if (!rel || (!rel.startsWith('..') && !path.isAbsolute(rel))) {
      throw new Error(`Refusing GitNexus internal directory as auto-sync clone root: ${root}`);

View on GitHub (pinned to 0d1aed942f)

Solutions

1. Move the clone root outside all DANGEROUS_PARENT_ROOTS — pick a sibling directory, not a child of a dangerous one
2. Use the default <globalDir>/repos location, which is explicitly whitelisted
3. Create a fresh top-level data directory (e.g. /var/lib/gitnexus or ~/gitnexus-repos) and configure that as the clone root

When it happens

Trigger: Thrown at gitnexus/src/core/auto-sync/path-security.ts:217 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of abhigyanpatwari/GitNexus@0d1aed942f (2026-09-08). Data as JSON: /api/errors/d59ab50d2260acb4. Report an issue: GitHub.