{"record":{"id":"58b39e8174c71e31","repo":"gastownhall/beads","slug":"remote-name-must-not-start-with-a-dash","errorCode":null,"errorMessage":"remote name must not start with a dash","messagePattern":"remote name must not start with a dash","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/remotecache/url.go","lineNumber":200,"sourceCode":"\tcolonIdx := strings.Index(rawURL[atIdx:], \":\")\n\tif atIdx < 0 || colonIdx < 0 {\n\t\treturn fmt.Errorf(\"SCP-style URL must be in user@host:path format\")\n\t}\n\treturn nil\n}\n\n// ValidateRemoteName checks that a remote name is safe for use as a Dolt\n// remote identifier. Names must start with a letter and contain only\n// alphanumeric characters, hyphens, and underscores. Max 64 characters.\nfunc ValidateRemoteName(name string) error {\n\tif name == \"\" {\n\t\treturn fmt.Errorf(\"remote name cannot be empty\")\n\t}\n\tif len(name) > 64 {\n\t\treturn fmt.Errorf(\"remote name too long (max 64 characters)\")\n\t}\n\tif strings.HasPrefix(name, \"-\") {\n\t\treturn fmt.Errorf(\"remote name must not start with a dash\")\n\t}\n\tif !validRemoteNameRegex.MatchString(name) {\n\t\treturn fmt.Errorf(\"remote name must start with a letter and contain only alphanumeric characters, hyphens, and underscores\")\n\t}\n\treturn nil\n}\n\n// MatchesRemotePattern checks whether a URL matches a glob-style pattern.\n// Patterns use path.Match semantics (e.g., \"dolthub://myorg/*\").\nfunc MatchesRemotePattern(rawURL, pattern string) bool {\n\tmatched, err := path.Match(pattern, rawURL)\n\tif err != nil {\n\t\treturn false\n\t}\n\treturn matched\n}\n\n// ValidateRemoteURLWithPatterns validates a URL and optionally checks it","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/remotecache/url.go#L182-L218","documentation":"A remote name starting with '-' would be interpreted as a CLI flag by flag-parsing code, enabling argument-injection mistakes. ValidateRemoteName rejects leading dashes explicitly before the regex check runs.","triggerScenarios":"Calling ValidateRemoteName(\"-foo\") or passing a name beginning with '-' to remote-adding flows, e.g. `bd remote add --name -weird <url>` or a variable that accidentally contains a dash-prefixed token.","commonSituations":"Scripts that concatenate flags into a name variable; users typing a dash by habit; names copied from diff/commit ranges like '-main'.","solutions":["Remove the leading dash or prefix the name with a letter (e.g. 'remote-foo').","Audit scripts for variables that may begin with '-' and quote/validate before passing.","Pick an alphanumeric-first alias such as 'origin' or 'upstream'."],"exampleFix":"// before\nValidateRemoteName(\"-staging\")\n// after\nValidateRemoteName(\"staging\")","handlingStrategy":"validation","validationCode":"if strings.HasPrefix(name, \"-\") {\n    return fmt.Errorf(\"remote name must not start with a dash\")\n}","typeGuard":null,"tryCatchPattern":"if err := remotecache.ValidateRemoteName(name); err != nil {\n    return fmt.Errorf(\"invalid remote name %q: %w\", name, err)\n}","preventionTips":["Sanitize names: strip leading dashes before passing to remote APIs.","Never build names from flag-like tokens or diff/commit ranges.","Quote and validate variables in shell scripts that feed the name argument."],"tags":["validation","remote","cli-injection"],"backgroundTag":"invalid-remote-name","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}