{"record":{"id":"3eae08f385780ca9","repo":"t8y2/dbx","slug":"root-count-checked-above","errorCode":null,"errorMessage":"root count checked above","messagePattern":"root count checked above","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/dbx-core/src/agent_service.rs","lineNumber":3162,"sourceCode":"fn extract_jre_tar<R: Read>(mut archive: tar::Archive<R>, dest: &Path) -> Result<(), String> {\n    let parent = dest.parent().ok_or_else(|| format!(\"Invalid JRE destination: {}\", dest.display()))?;\n    std::fs::create_dir_all(parent).map_err(|e| format!(\"Failed to create JRE directory: {e}\"))?;\n\n    let staging = tempfile::Builder::new()\n        .prefix(\".jre-extract-\")\n        .tempdir_in(parent)\n        .map_err(|e| format!(\"Failed to create JRE extraction directory: {e}\"))?;\n    archive.unpack(staging.path()).map_err(|e| format!(\"Failed to extract JRE archive: {e}\"))?;\n\n    let mut roots = std::fs::read_dir(staging.path())\n        .map_err(|e| format!(\"Failed to inspect extracted JRE archive: {e}\"))?\n        .collect::<Result<Vec<_>, _>>()\n        .map_err(|e| format!(\"Failed to inspect extracted JRE archive: {e}\"))?;\n    if roots.len() != 1 {\n        return Err(\"Invalid JRE archive: expected a single top-level directory\".to_string());\n    }\n\n    let root = roots.pop().expect(\"root count checked above\");\n    if !root.file_type().map_err(|e| format!(\"Failed to inspect extracted JRE archive: {e}\"))?.is_dir() {\n        return Err(\"Invalid JRE archive: expected a top-level directory\".to_string());\n    }\n\n    std::fs::create_dir_all(dest).map_err(|e| format!(\"Failed to create JRE directory: {e}\"))?;\n    for entry in std::fs::read_dir(root.path()).map_err(|e| format!(\"Failed to inspect extracted JRE archive: {e}\"))? {\n        let entry = entry.map_err(|e| format!(\"Failed to inspect extracted JRE archive: {e}\"))?;\n        std::fs::rename(entry.path(), dest.join(entry.file_name()))\n            .map_err(|e| format!(\"Failed to install extracted JRE: {e}\"))?;\n    }\n    Ok(())\n}\n\n#[cfg(test)]\nmod jre_archive_tests {\n    use super::*;\n    use std::io::Cursor;\n","sourceCodeStart":3144,"sourceCodeEnd":3180,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/crates/dbx-core/src/agent_service.rs#L3144-L3180","documentation":"While extracting an uploaded JRE archive, the code collects the top-level directory entries and requires exactly one root directory (\"Invalid JRE archive: expected a single top-level directory\" otherwise). It then takes roots.pop().expect(\"root count checked above\") — a guard-protected extraction that panics only if the len()!=1 check no longer precedes the pop (e.g. refactoring, or the Vec was mutated between check and use).","triggerScenarios":"Directly unreachable while the `if roots.len() != 1 { return Err(...) }` guard precedes roots.pop(). The underlying user-facing failure occurs when a JRE .tar.gz/.zip has zero or multiple top-level entries, which returns the Err, not the panic. The USED AT lines in agents/drivers (kingbase-go DSN tests, neo4j-go cert pool) are unrelated call sites surfaced by search, not part of this code path.","commonSituations":"Users upload JRE archives that were zipped from multiple folders or with files at the archive root instead of a single enclosing directory (common with macOS Finder 'compress' or selecting several items); extraction code refactors that drop the guard produce panics instead of the friendly Err.","solutions":["Repackage the JRE so it contains exactly one top-level directory (e.g. tar -czf jre.tar.gz jre/).","Keep the len()!=1 guard immediately before roots.pop(); never mutate `roots` between check and pop.","Replace expect with `let Some(root) = roots.pop() else { return Err(...) }` to make the invariant self-enforcing.","Validate archive layout (single root dir) client-side before upload to fail fast with a clear message."],"exampleFix":"// before\nlet root = roots.pop().expect(\"root count checked above\");\n// after\nlet Some(root) = roots.pop() else {\n    return Err(\"Invalid JRE archive: expected a single top-level directory\".to_string());\n};","handlingStrategy":"validation","validationCode":"// validate the JRE archive layout before extraction (client side)\nlet names: Vec<String> = list_archive_top_level(archive)?;\nif names.len() != 1 {\n    return Err(format!(\"JRE archive must have a single top-level directory, found {}\", names.len()));\n}","typeGuard":"fn single_root<'a>(entries: &'a [ArchiveEntry]) -> Option<&'a ArchiveEntry> {\n    if entries.len() == 1 { entries.first() } else { None }\n}","tryCatchPattern":"let Some(root) = roots.pop() else {\n    return Err(\"Invalid JRE archive: expected a single top-level directory\".to_string());\n};","preventionTips":["Repackage JRE archives so all contents live under one top-level directory.","Validate archive structure before upload/extraction.","Never mutate the entries Vec between the length check and pop.","Add tests for archives with 0 and 2+ root entries."],"tags":["rust","panic","invariant","archive-extraction","jre-install"],"backgroundTag":"empty-collection-unwrapping","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}