abhigyanpatwari/GitNexus · critical · SandboxError

sandbox_copy cannot import prebuilt graph or harness data: {

Error message

sandbox_copy cannot import prebuilt graph or harness data: {value}

What it means

Information-leak guard. Each string in sandbox_copy is checked by _is_restricted_path: an entry whose first component is '.gitnexus', or that equals or sits under HIDDEN_HARNESS_PATH, is rejected. The point is to stop a task from importing a prebuilt graph or harness/oracle tree into the sandbox, which would let an arm query cached answers and invalidate the benchmark.

Source

Thrown at eval/workflow_bench/sanitized_graph.py:92

def _is_restricted_path(value: str) -> bool:
    relative = PurePosixPath(value)
    if relative.is_absolute() or not relative.parts or ".." in relative.parts:
        return False
    return (
        relative.parts[0] == ".gitnexus" or relative == HIDDEN_HARNESS_PATH or HIDDEN_HARNESS_PATH in relative.parents
    )


def validate_no_prebuilt_graph_assets(task: Mapping[str, Any]) -> None:
    """Reject declarations that could reintroduce an unsanitized graph/oracle."""

    sandbox_copy = task.get("sandbox_copy", [])
    if not isinstance(sandbox_copy, list):
        raise SandboxError("sandbox_copy must be a list")
    for value in sandbox_copy:
        if isinstance(value, str) and _is_restricted_path(value):
            raise SandboxError(f"sandbox_copy cannot import prebuilt graph or harness data: {value}")

    dependencies = task.get("sandbox_dependencies", [])
    if not isinstance(dependencies, list):
        raise SandboxError("sandbox_dependencies must be a list")
    for item in dependencies:
        if not isinstance(item, Mapping):
            continue
        for field in ("source", "target"):
            value = item.get(field)
            if isinstance(value, str) and _is_restricted_path(value):
                raise SandboxError(f"sandbox dependency cannot expose prebuilt graph or harness data: {value}")


def _replace_control_file(root: Path, name: str, payload: bytes) -> None:
    path = root / name
    try:
        metadata = path.lstat()
    except FileNotFoundError:

View on GitHub (pinned to d540b00184)

Solutions

1. Remove any restricted path from sandbox_copy; the graph must be rebuilt inside the sandbox, not copied in.
2. If you copied a parent directory, enumerate only the non-restricted children explicitly.
3. Confirm the harness path you used is not HIDDEN_HARNESS_PATH or one of its ancestors.
4. Re-read the benchmark isolation contract: prebuilt graph/oracle data must never enter sandbox_copy.

Example fix

# before
sandbox_copy:
  - .gitnexus/meta.json
  - src/
# after
sandbox_copy:
  - src/

from pathlib import PurePosixPath

HIDDEN_HARNESS_PATH = "eval/workflow_bench"  # use the harness constant in real code

def is_restricted(value: str) -> bool:
    rel = PurePosixPath(value)
    if rel.is_absolute() or not rel.parts or ".." in rel.parts:
        return False
    return (rel.parts[0] == ".gitnexus"
            or rel == PurePosixPath(HIDDEN_HARNESS_PATH)
            or PurePosixPath(HIDDEN_HARNESS_PATH) in rel.parents)

bad = [v for v in task.get("sandbox_copy", []) if isinstance(v, str) and is_restricted(v)]
if bad:
    raise SystemExit(f"sandbox_copy leaks graph/harness data: {bad}")

from pathlib import PurePosixPath

def sandbox_copy_is_clean(values) -> bool:
    for value in values:
        rel = PurePosixPath(value)
        if rel.is_absolute() or not rel.parts or ".." in rel.parts:
            continue
        if rel.parts[0] == ".gitnexus":
            return False
    return True

try:
    validate_no_prebuilt_graph_assets(task)
except SandboxError as exc:
    if "cannot import prebuilt graph" in str(exc):
        log.error("sandbox_copy must not include .gitnexus/ or harness paths")
    raise

When it happens

Trigger: A task lists 'sandbox_copy: [.gitnexus/...]' or copies anything under the hidden harness path. Even an apparently innocent '.gitnexus/meta.json' is rejected because it is a graph asset.

Common situations: Author tries to seed an arm with a known-good graph to save indexing time; copies a whole repo subtree that happens to contain .gitnexus/; a fixture path collides with the hidden harness path.

Related errors

• sandbox dependency cannot expose prebuilt graph or harness d
• target .gitnexus path must be a real directory before graph
• {label} must be a real non-symlink directory: {path}
• {label} contains an unsafe path component: {relative}
• {label} must be a regular non-symlink file: {path}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/0b6db37ad84b06b9. Report an issue: GitHub.