{"record":{"id":"516b7a9cf7602fd2","repo":"santifer/career-ops","slug":"a-40-hex-commit-sha-is-required-got-json-stri","errorCode":null,"errorMessage":"a 40-hex commit --sha is required (got ${JSON.stringify(sha)})","messagePattern":"a 40-hex commit --sha is required \\(got (.+?)\\)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"plugin-install.mjs","lineNumber":42,"sourceCode":"const NAME_RE = /^career-ops-plugin-([a-z0-9][a-z0-9-]*)$/;\nconst SHA_RE = /^[0-9a-f]{40}$/;\nconst MIN_FILES = ['manifest.json', 'index.mjs', 'README.md', 'LICENSE'];\n\n/** Normalize `owner/repo` | full URL into a validated github URL + the plugin id. */\nexport function parseRepoArg(arg) {\n  let url = arg;\n  if (/^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/.test(arg)) url = `https://github.com/${arg}`;\n  url = url.replace(/\\.git$/, '');\n  if (!GITHUB_URL_RE.test(url)) throw new Error(`refusing non-GitHub/unsafe repo URL: ${arg} (expected https://github.com/<owner>/<repo>)`);\n  const repoName = url.split('/').pop() || '';\n  const m = NAME_RE.exec(repoName);\n  if (!m) throw new Error(`repo must be named \"career-ops-plugin-<name>\" (got \"${repoName}\")`);\n  return { url, id: m[1] };\n}\n\n/** Clone the EXACT pinned SHA into a fresh temp dir. Returns the temp dir path. */\nexport function safeClone(url, sha) {\n  if (!SHA_RE.test(sha || '')) throw new Error(`a 40-hex commit --sha is required (got ${JSON.stringify(sha)})`);\n  const dir = mkdtempSync(path.join(tmpdir(), 'co-plugin-'));\n  const git = (...args) => execFileSync('git', ['-c', 'protocol.ext.allow=never', '-c', 'protocol.file.allow=never', ...args], { stdio: ['ignore', 'ignore', 'pipe'], timeout: 120_000 });\n  try {\n    git('-C', dir, 'init', '-q');\n    git('-C', dir, 'remote', 'add', 'origin', '--', url);\n    git('-C', dir, 'fetch', '--depth', '1', '--no-tags', '-q', 'origin', sha);\n    git('-C', dir, 'checkout', '-q', 'FETCH_HEAD');\n    rmSync(path.join(dir, '.git'), { recursive: true, force: true }); // drop VCS metadata (and any hooks)\n    return dir;\n  } catch (err) {\n    rmSync(dir, { recursive: true, force: true });\n    throw new Error(`clone of ${url}@${sha.slice(0, 10)} failed — ${err.stderr ? String(err.stderr).slice(0, 200) : err.message}`);\n  }\n}\n\n/** Check the minimum file set + a valid manifest whose id matches `expectId`. */\nexport function validateInstall(dir, expectId) {\n  const problems = [];","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/santifer/career-ops/blob/aac998c7ed7248ea853b720ceeb1fdbeb322fc5d/plugin-install.mjs#L24-L60","documentation":"safeClone fetches exactly one pinned commit; the sha must be a full 40-character hex SHA-1 so the exact revision is unambiguous and un-forgeable. Anything else — short sha, branch/tag name, empty or non-string value — is refused with this message before any git command runs.","triggerScenarios":"safeClone(url, sha) called with a short sha (7-10 chars from GitHub UI), a tag/branch name like 'main', an empty string, undefined/null, or a 64-hex sha256 (future git object format).","commonSituations":"User copies the short sha from the GitHub commit list; passes the default branch instead of a commit; forgets --sha on the CLI so it arrives undefined; a script stores the sha of a subdirectory commit log line including decoration text.","solutions":["Get the full sha: `git ls-remote https://github.com/owner/career-ops-plugin-<name> <ref>` or the 'Copy full SHA for permalink' button on GitHub","Pass the complete 40-hex string via --sha on the CLI","Fix scripts that truncate or prefix the sha; never pass branch or tag names","If pinning is awkward, record the full sha once at review time and store it in your install config"],"exampleFix":"// before\nnode plugins.mjs install acme/career-ops-plugin-demo --sha a1b2c3d\n// after\nnode plugins.mjs install acme/career-ops-plugin-demo --sha a1b2c3d4e5f6... (full 40 hex chars)","handlingStrategy":"validation","validationCode":"if (!/^[0-9a-f]{40}$/.test(sha)) throw new Error(`--sha must be a full 40-hex commit SHA, got: ${sha}`);","typeGuard":"const isFullSha = (s) => typeof s === 'string' && /^[0-9a-f]{40}$/.test(s);","tryCatchPattern":"try { const dir = safeClone(url, sha); } catch (e) { if (e.message.includes('40-hex commit --sha is required')) { console.error('Resolve the full sha: git ls-remote <url> <ref>'); } else throw e; }","preventionTips":["Always pin the full 40-hex sha from git ls-remote or GitHub's copy-full-sha button","Never pass branch or tag names as sha","Require --sha explicitly in scripts; fail fast when it is undefined","Store the pinned sha in a reviewed config rather than deriving it at runtime"],"tags":["git","validation","sha","security"],"backgroundTag":"invalid-argument-format","analyzedSha":"aac998c7ed7248ea853b720ceeb1fdbeb322fc5d","analyzedAt":"2026-09-16T06:35:29.214Z","contentChangedAt":"2026-09-16T06:35:29.214Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}