{"record":{"id":"53af1f10a4a9b4f3","repo":"abhigyanpatwari/GitNexus","slug":"task-asset-snapshot-contains-a-special-file-path","errorCode":null,"errorMessage":"task asset snapshot contains a special file: {path}","messagePattern":"task asset snapshot contains a special file: (.+?)","errorType":"exception","errorClass":"SandboxError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/task_assets.py","lineNumber":996,"sourceCode":"        \"repo_identity\": str(repo_identity),\n        \"resolved_sha\": resolved_sha,\n        \"schema_version\": 2,\n    }\n    return hashlib.sha256(json.dumps(payload, sort_keys=True, separators=(\",\", \":\")).encode()).hexdigest()\n\n\ndef _freeze_snapshot(root: Path) -> None:\n    for current, directories, files in os.walk(root, topdown=False, followlinks=False):\n        for name in files:\n            path = Path(current) / name\n            mode = path.lstat().st_mode\n            relative = path.relative_to(root)\n            if stat.S_ISLNK(mode):\n                if not relative.parts or relative.parts[0] != \"dependencies\":\n                    raise SandboxError(f\"task asset snapshot contains an unexpected symlink: {path}\")\n                continue\n            if not stat.S_ISREG(mode):\n                raise SandboxError(f\"task asset snapshot contains a special file: {path}\")\n            path.chmod(0o400 | (0o100 if stat.S_IMODE(mode) & 0o111 else 0))\n        for name in directories:\n            path = Path(current) / name\n            mode = path.lstat().st_mode\n            relative = path.relative_to(root)\n            if stat.S_ISLNK(mode):\n                if not relative.parts or relative.parts[0] != \"dependencies\":\n                    raise SandboxError(f\"task asset snapshot contains an unexpected symlink: {path}\")\n                continue\n            if not stat.S_ISDIR(mode):\n                raise SandboxError(f\"task asset snapshot contains a special directory: {path}\")\n            path.chmod(0o500)\n        Path(current).chmod(0o500)\n\n\ndef _thaw_tree(root: Path) -> None:\n    for current, directories, files in os.walk(root, topdown=True, followlinks=False):\n        Path(current).chmod(0o700)","sourceCodeStart":978,"sourceCodeEnd":1014,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/task_assets.py#L978-L1014","documentation":"Raised by _freeze_snapshot during the files walk when an entry reported by os.walk as a file is neither a symlink nor a regular file (stat.S_ISREG false). FIFOs, Unix sockets, character/block devices, and other special files are rejected because the snapshot model only supports regular files and (under dependencies/) symlinks.","triggerScenarios":"The captured snapshot tree contains a non-regular file: a leftover mkfifo FIFO, a .sock unix socket from a dev server, a /dev bind, or a door on Solaris. os.walk lists it under files but lstat says it is not S_ISREG.","commonSituations":"Pointing sandbox_copy at a repo dir that contains a dev-server socket or build FIFO; test fixtures that create named pipes; container bind-mounts leaking device nodes; CI cache directories with socket files.","solutions":["Delete the special file from the captured source tree before capture (rm the .sock / FIFO / device).","Exclude the directory containing the special file from the sandbox_copy declaration.","If the special file is legitimately needed, the snapshot format does not support it — generate it inside the clone at run time instead."],"exampleFix":"# before: dev socket captured into the snapshot\nrepo/.vite/vite.sock  ->  freeze raises 'special file'\n\n# after: exclude the runtime socket dir from sandbox_copy\nsandbox_copy = ['src', 'public']   # do not capture '.vite' or '.cache'","handlingStrategy":"validation","validationCode":"import os, stat\nfrom pathlib import Path\n\ndef assert_only_regular_files(root: Path) -> None:\n    for current, _, files in os.walk(root, followlinks=False):\n        for name in files:\n            mode = (Path(current) / name).lstat().st_mode\n            if not (stat.S_ISREG(mode) or stat.S_ISLNK(mode)):\n                raise ValueError(f'non-regular file would be rejected by freeze: {Path(current)/name}')\n\n# Run before cache.prepare; delete or exclude FIFOs/sockets/devices from the captured tree.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not point sandbox_copy at directories containing dev-server sockets, FIFOs, or device nodes.","Clean .vite/.cache/.sock artifacts from the repo before capture.","Generate runtime-only special files inside the clone, not from the snapshot."],"tags":["sandbox","filesystem","security","validation"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}