{"record":{"id":"204fc5e5fef93870","repo":"stablyai/orca","slug":"refusing-to-use-an-unexpected-guest-cleanup-path","errorCode":null,"errorMessage":"Refusing to use an unexpected guest cleanup path","messagePattern":"Refusing to use an unexpected guest cleanup path","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"config/scripts/wsl-hook-relay-reattach-benchmark.mjs","lineNumber":347,"sourceCode":"      null\n    )\n    wslHookRelayManager.ensureForDistro = previousEnsure\n    if (singletonProbe.length !== 1 || singletonProbe[0] !== '__bench-singleton-probe__') {\n      throw new Error(\n        'jiti duplicated the WSL hook-relay manager graph; reattach patch would not observe pty.ts'\n      )\n    }\n\n    const guestHome = (\n      await run('wsl.exe', wslArgs(distro, ['/bin/sh', '-c', 'printf %s \"$HOME\"']))\n    ).stdout.trim()\n    const instanceKey = `bench-${process.pid}-${Date.now().toString(36)}`\n    const benchmarkRoot = `${guestHome}/.orca-wsl/benchmarks/${instanceKey}`\n    const scriptPath = `${benchmarkRoot}/.orca/agent-hooks/codex-hook.sh`\n    const endpointPath = `${guestHome}/.orca-wsl/agent-hooks/instance-${instanceKey}/endpoint.env`\n    cleanupPaths = [benchmarkRoot, `${guestHome}/.orca-wsl/agent-hooks/instance-${instanceKey}`]\n    if (cleanupPaths.some((cleanupPath) => !cleanupPath.startsWith(`${guestHome}/.orca-wsl/`))) {\n      throw new Error('Refusing to use an unexpected guest cleanup path')\n    }\n    const disabledTuiAgents = MANAGED_AGENT_HOOK_TARGETS.filter(\n      (target) => target.tuiAgent !== 'codex'\n    ).map((target) => target.tuiAgent)\n    const bundleVersion = readFileSync(versionPath, 'utf8').trim()\n    const warnings = []\n    const relayRefreshes = []\n    let delivered = 0\n\n    // Why: pty.ts refreshes through the production singleton, so route that singleton at the\n    // benchmark-scoped manager instead of calling the reattach helper from here — a removed or\n    // mislocated integration call in pty.ts must fail this benchmark.\n    wslHookRelayManager.ensureForDistro = (refreshedDistro) => {\n      relayRefreshes.push(refreshedDistro)\n      manager?.ensureForDistro(refreshedDistro)\n    }\n\n    const { runtime, getController } = createRuntimeStub()","sourceCodeStart":329,"sourceCodeEnd":365,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/scripts/wsl-hook-relay-reattach-benchmark.mjs#L329-L365","documentation":"Safety guard in the benchmark's teardown logic: it computes cleanupPaths under `${guestHome}/.orca-wsl/benchmarks/<instanceKey>` and `${guestHome}/.orca-wsl/agent-hooks/instance-<instanceKey>`, then refuses to proceed if any path does not begin with `${guestHome}/.orca-wsl/`. This prevents destructive rm -rf against an unexpected location if HOME resolution or path construction goes wrong.","triggerScenarios":"guestHome resolves to an empty/unexpected value (e.g. WSL prints an error to stdout instead of $HOME), or instanceKey contains characters that break the path prefix check, making cleanupPaths fall outside the allowed root.","commonSituations":"WSL distro where `printf %s \"$HOME\"` returns empty or an error string, a HOME set to something other than the expected user directory, or a future refactor that changes benchmarkRoot/endpointPath without updating the prefix guard.","solutions":["Run `wsl.exe -d <distro> /bin/sh -c 'printf %s \"$HOME\"'` and confirm it prints the expected home path.","Ensure the distro's user profile is intact and HOME is exported in the default shell.","If you intentionally changed the benchmark layout, update the `.startsWith(guestHome/.orca-wsl/)` guard to match the new root.","Never widen this guard casually — it exists to prevent accidental deletion outside .orca-wsl."],"exampleFix":"// before\nif (cleanupPaths.some((cleanupPath) => !cleanupPath.startsWith(`${guestHome}/.orca-wsl/`))) {\n  throw new Error('Refusing to use an unexpected guest cleanup path')\n}\n\n// after — name the offending path in the message\nconst bad = cleanupPaths.find((p) => !p.startsWith(`${guestHome}/.orca-wsl/`))\nif (bad) {\n  throw new Error(`Refusing to use an unexpected guest cleanup path: ${bad} (guestHome=${guestHome})`)\n}","handlingStrategy":"validation","validationCode":"// Validate guestHome is non-empty and absolute before computing cleanupPaths\nif (!guestHome || !guestHome.startsWith('/') || guestHome.includes('\\n')) {\n  throw new Error(`Unresolvable guest HOME: ${JSON.stringify(guestHome)}`)\n}","typeGuard":"function isPathUnderRoot(p: string, root: string): boolean {\n  const norm = p.replace(/\\\\/g, '/')\n  return norm.startsWith(root.endsWith('/') ? root : root + '/')\n}","tryCatchPattern":null,"preventionTips":["Never weaken this guard to 'make the benchmark run' — it prevents destructive rm -rf.","Confirm `printf %s \"$HOME\"` output on the target distro before each benchmark run.","Keep instanceKey to [a-z0-9-] so it cannot break the path prefix."],"tags":["wsl","benchmark","filesystem-safety","destructive-guard","teardown"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}