abhigyanpatwari/GitNexus · critical · SandboxError

sandbox dependency cannot expose prebuilt graph or harness d

Error message

sandbox dependency cannot expose prebuilt graph or harness data: {value}

What it means

Information-leak guard for sandbox_dependencies, symmetric to error 554. For each dependency Mapping, both its 'source' and 'target' strings are checked by _is_restricted_path; either pointing at '.gitnexus', HIDDEN_HARNESS_PATH, or a descendant rejects the dependency. This blocks mounting a prebuilt graph or harness/oracle tree via the dependency mechanism.

Source

Thrown at eval/workflow_bench/sanitized_graph.py:103

    """Reject declarations that could reintroduce an unsanitized graph/oracle."""

    sandbox_copy = task.get("sandbox_copy", [])
    if not isinstance(sandbox_copy, list):
        raise SandboxError("sandbox_copy must be a list")
    for value in sandbox_copy:
        if isinstance(value, str) and _is_restricted_path(value):
            raise SandboxError(f"sandbox_copy cannot import prebuilt graph or harness data: {value}")

    dependencies = task.get("sandbox_dependencies", [])
    if not isinstance(dependencies, list):
        raise SandboxError("sandbox_dependencies must be a list")
    for item in dependencies:
        if not isinstance(item, Mapping):
            continue
        for field in ("source", "target"):
            value = item.get(field)
            if isinstance(value, str) and _is_restricted_path(value):
                raise SandboxError(f"sandbox dependency cannot expose prebuilt graph or harness data: {value}")


def _replace_control_file(root: Path, name: str, payload: bytes) -> None:
    path = root / name
    try:
        metadata = path.lstat()
    except FileNotFoundError:
        metadata = None
    if metadata is not None:
        if stat.S_ISDIR(metadata.st_mode):
            raise SandboxError(f"target-controlled {name} must not be a directory")
        path.unlink()
    descriptor = os.open(
        path,
        os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0),
        0o600,
    )
    try:

View on GitHub (pinned to d540b00184)

Solutions

1. Change the source/target so neither component starts with .gitnexus and neither is the hidden harness path or beneath it.
2. If you need shared code, put it outside .gitnexus and reference that path.
3. Re-read the isolation contract: dependencies must not expose prebuilt graph or oracle/harness data.
4. Audit every dependency entry's source and target with the same _is_restricted_path rule.

Example fix

# before
sandbox_dependencies:
  - source: .gitnexus/cache
    target: .gitnexus/cache
# after (drop the dependency; the graph is rebuilt in-sandbox)
sandbox_dependencies: []

from pathlib import PurePosixPath
from collections.abc import Mapping

HIDDEN_HARNESS_PATH = "eval/workflow_bench"

def is_restricted(value: str) -> bool:
    rel = PurePosixPath(value)
    if rel.is_absolute() or not rel.parts or ".." in rel.parts:
        return False
    return (rel.parts[0] == ".gitnexus"
            or rel == PurePosixPath(HIDDEN_HARNESS_PATH)
            or PurePosixPath(HIDDEN_HARNESS_PATH) in rel.parents)

bad = []
for item in task.get("sandbox_dependencies", []):
    if not isinstance(item, Mapping):
        continue
    for field in ("source", "target"):
        v = item.get(field)
        if isinstance(v, str) and is_restricted(v):
            bad.append((field, v))
if bad:
    raise SystemExit(f"dependencies leak graph/harness data: {bad}")

from pathlib import PurePosixPath
from collections.abc import Mapping

def dependencies_are_clean(deps) -> bool:
    for item in deps:
        if not isinstance(item, Mapping):
            continue
        for field in ("source", "target"):
            value = item.get(field)
            if not isinstance(value, str):
                continue
            rel = PurePosixPath(value)
            if rel.is_absolute() or not rel.parts or ".." in rel.parts:
                continue
            if rel.parts[0] == ".gitnexus":
                return False
    return True

try:
    validate_no_prebuilt_graph_assets(task)
except SandboxError as exc:
    if "dependency cannot expose prebuilt graph" in str(exc):
        log.error("a dependency source/target points at .gitnexus/ or harness paths")
    raise

When it happens

Trigger: A sandbox_dependencies entry has source or target equal to or under .gitnexus/ or the hidden harness path. Non-Mapping entries are silently skipped; only Mapping items with string source/target are scanned.

Common situations: Author mounts a shared graph directory as a dependency to skip re-indexing; a target path was chosen to mirror the repo layout and accidentally lands under .gitnexus/; copying a dependency template that referenced harness paths.

Related errors

• sandbox_copy cannot import prebuilt graph or harness data: {
• target .gitnexus path must be a real directory before graph
• {label} must be a real non-symlink directory: {path}
• {label} contains an unsafe path component: {relative}
• {label} must be a regular non-symlink file: {path}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/087e65bea0d834b8. Report an issue: GitHub.