{"record":{"id":"249514efae226cc2","repo":"abhigyanpatwari/GitNexus","slug":"label-does-not-exist-relative","errorCode":null,"errorMessage":"{label} does not exist: {relative}","messagePattern":"(.+?) does not exist: (.+?)","errorType":"exception","errorClass":"SandboxError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/proposer_sandbox.py","lineNumber":572,"sourceCode":"    except OSError as exc:\n        raise SandboxError(f\"{label} must be a real directory: {lexical}: {exc}\") from exc\n    if resolved != lexical:\n        raise SandboxError(f\"{label} must not traverse symlinks: {lexical}\")\n    return lexical\n\n\ndef _safe_repo_source(repo: Path, relative: str, *, label: str) -> tuple[Path, Path]:\n    candidate = PurePosixPath(relative)\n    if candidate.is_absolute() or \"..\" in candidate.parts or not candidate.parts:\n        raise SandboxError(f\"{label} must be a repository-relative path: {relative!r}\")\n    lexical = repo / Path(*candidate.parts)\n    resolved = lexical.resolve()\n    try:\n        resolved.relative_to(repo)\n    except ValueError as exc:\n        raise SandboxError(f\"{label} escapes its allowed repository root: {relative}\") from exc\n    if not resolved.exists():\n        raise SandboxError(f\"{label} does not exist: {relative}\")\n    return lexical, resolved\n\n\ndef _prepare_clone_target(\n    clone: Path,\n    relative: PurePosixPath,\n    *,\n    directory: bool | None,\n    label: str,\n) -> Path:\n    \"\"\"Validate/create a clone-local target without following any symlink.\n\n    This runs before Bubblewrap, so ordinary ``Path.mkdir``/``touch`` calls\n    are not acceptable: an untrusted tracked parent symlink could redirect a\n    mount placeholder write into the host filesystem.\n    \"\"\"\n\n    flags = os.O_RDONLY | os.O_DIRECTORY | getattr(os, \"O_CLOEXEC\", 0)","sourceCodeStart":554,"sourceCodeEnd":590,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/proposer_sandbox.py#L554-L590","documentation":"Raised by _safe_repo_source, the trust-boundary validator for any task-declared repo-relative asset source. After confirming the path is repo-relative and cannot escape the repository root, it requires the resolved path to actually exist on disk; a missing file or directory is rejected because the subsequent read-only bubblewrap mount would silently fail or, worse, be redirected. This runs before containment starts, so the harness refuses to stage a non-existent asset rather than weaken the contract.","triggerScenarios":"A task YAML entry declares a dependency/asset source path (e.g. a node_modules snapshot, a fixture, or a config file) whose relative path does not exist under the resolved repo root at the task's checked-out SHA. Concretely: stage_task_assets -> _safe_repo_source(repo, relative, label=...) where Path(repo / relative).resolve().exists() is False.","commonSituations":"Path typo or wrong casing in the task file (especially macOS dev authoring vs. case-sensitive Linux CI); asset was renamed/moved after the task was authored; harness invoked from a different CWD or with a different --repo so 'repo' resolves elsewhere; asset exists only on a branch that is not checked out; the asset is generated by a setup step that ran in a different worktree.","solutions":["Copy the exact relative path from the error and run `ls -la <repo>/<relative>` against the repo root the harness uses (the worktree at the task SHA, not your working copy).","Confirm the asset is committed at that relative path in the resolved SHA: `git -C <repo> cat-file -e <sha>:<relative>`.","If the path is wrong, fix the source/asset entry in the task YAML to the correct repository-relative path.","If the asset is produced dynamically, ensure the producing step runs before staging and writes into the same worktree the harness will bind."],"exampleFix":"// task YAML (before)\nassets:\n  - source: eval/workflow_bench/fixtures/NodeModules.json\n// after — corrected relative path that exists in the repo\nassets:\n  - source: eval/workflow_bench/fixtures/node_modules.json","handlingStrategy":"validation","validationCode":"from pathlib import Path, PurePosixPath\n\ndef assert_repo_source_exists(repo: Path, relative: str) -> None:\n    cand = PurePosixPath(relative)\n    assert not cand.is_absolute() and '..' not in cand.parts and cand.parts, relative\n    resolved = (repo / Path(*cand.parts)).resolve()\n    resolved.relative_to(repo)  # raises ValueError if it escapes\n    assert resolved.exists(), f'{relative} does not exist under {repo}'","typeGuard":null,"tryCatchPattern":"from .proposer_sandbox import SandboxError\n\ntry:\n    lexical, resolved = _safe_repo_source(repo, relative, label='asset')\nexcept SandboxError as exc:\n    # surface to the task author; do not proceed to staging\n    raise","preventionTips":["Author task asset paths as repository-relative, case-checked against a case-sensitive checkout.","Validate every task file's asset paths against the repo in CI before running the harness.","Run the harness from a stable CWD and pass --repo explicitly."],"tags":["sandbox","path-validation","trust-boundary","task-assets"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}