abhigyanpatwari/GitNexus · error · SandboxError

sanitized graph source exceeds the scrub entry limit

Error message

sanitized graph source exceeds the scrub entry limit

What it means

Raised when the cumulative count of visited entries in the seed tree exceeds MAX_GRAPH_SCRUB_ENTRIES (250_000). Each non-.git/.gitnexus entry increments the counter; breaching the cap means the seed is too large to scrub within a bounded time/memory budget, so the harness fails closed rather than scan only part of the tree.

Source

Thrown at eval/workflow_bench/sanitized_graph.py:175

    marker_bytes = tuple(marker.encode() for marker in GRAPH_MARKERS)
    pending: list[tuple[Path, PurePosixPath]] = [(root, PurePosixPath())]
    removed: list[str] = []
    entries = 0
    scanned_bytes = 0
    while pending:
        directory, relative_directory = pending.pop()
        try:
            children = sorted(os.scandir(directory), key=lambda item: item.name, reverse=True)
        except OSError as exc:
            raise SandboxError(f"cannot scan sanitized graph source: {directory}: {exc}") from exc
        for entry in children:
            relative = relative_directory / entry.name
            if relative.parts[0] in {".git", ".gitnexus"}:
                continue
            entries += 1
            if entries > MAX_GRAPH_SCRUB_ENTRIES:
                raise SandboxError("sanitized graph source exceeds the scrub entry limit")
            relative_text = relative.as_posix()
            metadata = entry.stat(follow_symlinks=False)
            path_matches = any(marker in relative_text for marker in GRAPH_MARKERS)
            if path_matches:
                path = Path(entry.path)
                if stat.S_ISDIR(metadata.st_mode) and not stat.S_ISLNK(metadata.st_mode):
                    shutil.rmtree(path)
                else:
                    path.unlink()
                removed.append(relative_text)
                continue
            if stat.S_ISDIR(metadata.st_mode):
                pending.append((Path(entry.path), relative))
                continue
            if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISREG(metadata.st_mode):
                continue
            if metadata.st_size > MAX_GRAPH_SCRUB_FILE_BYTES:
                continue

View on GitHub (pinned to d540b00184)

Solutions

1. Trim the task snapshot so the non-.git/.gitnexus entry count is well under 250_000 (exclude node_modules, dist, build artifacts).
2. Move bulky read-only subtrees into a sandbox_dependencies mount instead of sandbox_copy so they are not part of the scrubbed seed.
3. If the limit is genuinely too low for a legitimate task, raise MAX_GRAPH_SCRUB_ENTRIES only after confirming scrub wall-clock stays bounded.

import os
from workflow_bench.sanitized_graph import MAX_GRAPH_SCRUB_ENTRIES

def estimate_scrub_entries(root):
    count = 0
    for dirpath, dirnames, files in os.walk(root):
        parts = os.path.relpath(dirpath, root).split(os.sep)
        if parts and parts[0] in {".git", ".gitnexus"}:
            dirnames[:] = []
            continue
        count += len(dirnames) + len(files)
        if count > MAX_GRAPH_SCRUB_ENTRIES:
            raise RuntimeError(f"seed has ~{count} entries; exceeds scrub limit {MAX_GRAPH_SCRUB_ENTRIES}")
    return count

When it happens

Trigger: A task whose history-pruned snapshot still contains more than 250_000 non-.git/.gitnexus entries (huge node_modules, generated sources, vendored trees) is passed to prepare_sanitized_graph.

Common situations: Task declaration does not exclude node_modules/build outputs; a monorepo snapshot is too broad; scrubbing runs before indexing, so .gitnexusignore neutralization does not reduce file count.

Related errors

• sanitized graph source exceeds the scrub byte limit
• transcript_artifacts exceeds the per-row session limit of {M
• transcript_artifacts exceeds the global evidence limit of {M
• {label} is unavailable: {path}: {exc}
• {label} must be a real non-symlink directory: {path}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/45532d18bbf01a6a. Report an issue: GitHub.