abhigyanpatwari/GitNexus · error · GitNexusRcError

${source} must not contain Markdown-significant characters (

Error message

${source} must not contain Markdown-significant characters (` * [ ] < >).

What it means

Thrown by normalizeValue() in the 'string' case when the trimmed value contains a Markdown-significant character: backtick, asterisk, [, ], <, or >. The 'name' value is interpolated into AGENTS.md/CLAUDE.md as **${name}** and inside gitnexus://repo/${name}/... code spans, so any of these characters could break the span or inject emphasis, links, or raw HTML into agent-instruction content. Underscore is intentionally allowed (legitimate in repo names and not emphasis mid-word). embeddingDevice only holds a fixed device token so this guard never rejects a valid device.

Source

Thrown at gitnexus/src/cli/analyze-config.ts:245

      return validateBranchName(value, source);
    case 'string': {
      if (typeof value !== 'string') {
        throw new GitNexusRcError(`${source} must be a string.`);
      }
      const trimmed = value.trim();
      if (!trimmed) {
        throw new GitNexusRcError(`${source} must not be empty.`);
      }
      assertNoHiddenChars(trimmed, source);
      // `name` flows into the generated AGENTS.md/CLAUDE.md as `**${name}**` and
      // inside `gitnexus://repo/${name}/…` code spans, so a Markdown-significant
      // character would break those spans or inject emphasis/links/HTML into
      // agent-instruction content (#1996 tri-review P1). `_` is intentionally
      // allowed (legitimate in repo names; intraword `_` is not emphasis).
      // embeddingDevice (the other `string`-kind option) only ever holds a
      // fixed device token, so this guard never rejects a valid value there.
      if (/[`*[\]<>]/.test(trimmed)) {
        throw new GitNexusRcError(
          `${source} must not contain Markdown-significant characters (\` * [ ] < >).`,
        );
      }
      return trimmed;
    }
    case 'string-array': {
      // Generic shared validator — `source` already names the config key, so
      // messages here stay key-agnostic (no fetch-wrapper coupling in the
      // shared normalizer; #1589/#1852 review F7).
      if (!Array.isArray(value)) {
        throw new GitNexusRcError(`${source} must be an array of strings.`);
      }
      const names: string[] = [];
      for (const item of value) {
        if (typeof item !== 'string') {
          throw new GitNexusRcError(`${source} entries must all be strings.`);
        }
        const trimmed = item.trim();

View on GitHub (pinned to d540b00184)

Solutions

1. Use a repo name without Markdown-significant characters (letters, digits, '-', '_', '.').
2. If the real repo name contains such a character, choose a display alias for the config.
3. Audit the value for stray formatting copied from a rich-text source.

Example fix

// before
{ "name": "my*repo`" }

// after
{ "name": "my-repo" }

function assertNoMarkdownChars(value: string, key: string): void {
  if (/[`*[\]<>]/.test(value)) {
    throw new Error(`${key} must not contain Markdown-significant characters`);
  }
}

function isMarkdownSafe(value: unknown): value is string {
  return typeof value === 'string' && !/[`*[\]<>]/.test(value);
}

When it happens

Trigger: Setting "name": "my*repo", "name": "a[b]c", "name": "a<b>", "name": "a`b", or "name": "*>x" in .gitnexusrc.

Common situations: A repo name containing glob-like characters; a paste that included markdown formatting; an attempt to set a name with angle brackets from a template; an adversarial config testing prompt injection.

Related errors

• ${source}: value contains control or hidden/bidirectional ch
• ${source}: branch name must not contain a backtick (it would
• Invalid backend URL: must be a well-formed http:// or https:
• Backend URL must use http:// or https:// (got ${parsed.proto
• ${source}: branch name contains characters not allowed in a

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/c7c5058f94043105. Report an issue: GitHub.