{"record":{"id":"3570ee950e9ea909","repo":"abhigyanpatwari/GitNexus","slug":"pinned-gitnexus-runtime-entrypoint-must-be-regular","errorCode":null,"errorMessage":"pinned GitNexus runtime entrypoint must be regular and non-symlink: {entrypoint}","messagePattern":"pinned GitNexus runtime entrypoint must be regular and non-symlink: (.+?)","errorType":"exception","errorClass":"SandboxError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/runtime_mounts.py","lineNumber":235,"sourceCode":"            f\"{SANDBOX_GITNEXUS_SHARED}/package.json\",\n            directory=False,\n        ),\n        _validated_runtime_component(\n            runtime,\n            \"hooks/claude\",\n            f\"{SANDBOX_GITNEXUS}/hooks/claude\",\n            directory=True,\n        ),\n    )\n\n    entrypoint = mounts[0].source / \"cli\" / \"index.js\"\n    try:\n        entrypoint_mode = entrypoint.lstat().st_mode\n        package = json.loads(mounts[1].source.read_text())\n    except (OSError, json.JSONDecodeError) as exc:\n        raise SandboxError(f\"pinned GitNexus runtime metadata is invalid: {exc}\") from exc\n    if stat.S_ISLNK(entrypoint_mode) or not stat.S_ISREG(entrypoint_mode):\n        raise SandboxError(f\"pinned GitNexus runtime entrypoint must be regular and non-symlink: {entrypoint}\")\n    if package.get(\"version\") != PINNED_GITNEXUS_VERSION:\n        raise SandboxError(\n            \"pinned GitNexus runtime version drifted: \"\n            f\"expected {PINNED_GITNEXUS_VERSION}, got {package.get('version')!r}\"\n        )\n\n    linked_shared = mounts[2].source / \"gitnexus-shared\"\n    if not linked_shared.is_symlink() or linked_shared.resolve(strict=True) != shared:\n        raise SandboxError(\"pinned GitNexus runtime has an unexpected gitnexus-shared dependency\")\n    try:\n        shared_package = json.loads(mounts[5].source.read_text())\n    except (OSError, json.JSONDecodeError) as exc:\n        raise SandboxError(f\"pinned GitNexus shared runtime metadata is invalid: {exc}\") from exc\n    if shared_package.get(\"name\") != \"gitnexus-shared\":\n        raise SandboxError(\"pinned GitNexus shared runtime has an unexpected package identity\")\n    return mounts\n\n","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/runtime_mounts.py#L217-L253","documentation":"After metadata reads succeed, the harness stat-checks dist/cli/index.js and rejects it if it is a symlink or anything other than a regular file (stat.S_ISREG). This blocks symlink-based TOCTOU attacks on the runtime entrypoint that could swap behavior between validation and execution.","triggerScenarios":"dist/cli/index.js is a symlink (e.g., created by pnpm or yarn PnP, or manually for debugging), a broken symlink, or a non-regular file (FIFO/device).","commonSituations":"Switching to a package manager that hard-links/symlinks dist artifacts; manually symlinking index.js to a different CLI build; a partial clean that left a dangling symlink.","solutions":["Inspect the file type: `ls -l gitnexus/dist/cli/index.js` — the mode should start with `-`, not `l`.","Rebuild from a clean state so tsc emits a real file: `rm -rf gitnexus/dist && cd gitnexus && npm run build`.","If using pnpm/yarn workspaces, configure it to copy rather than symlink the dist artifact, or run the build under npm."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import stat\nfrom pathlib import Path\n\ndef entrypoint_is_regular(path: Path) -> bool:\n    try:\n        mode = path.lstat().st_mode\n    except OSError:\n        return False\n    return stat.S_ISREG(mode) and not stat.S_ISLNK(mode)","typeGuard":null,"tryCatchPattern":"try:\n    mounts = trusted_gitnexus_runtime_mounts()\nexcept SandboxError as exc:\n    if \"entrypoint must be regular\" in str(exc):\n        # rebuild dist before retrying\n        ...\n    raise","preventionTips":["Build dist with `npm run build` rather than symlinking from another checkout.","Avoid package managers that symlink dist artifacts (or configure them to copy).","After build, `ls -l gitnexus/dist/cli/index.js` should show a regular file."],"tags":["sandbox","symlink-guard","gitnexus-runtime","filesystem"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}