{"record":{"id":"6a952ddbac923fd5","repo":"ipfs/kubo","slug":"this-is-a-potentially-destructive-operation-pass","errorCode":null,"errorMessage":"this is a potentially destructive operation; pass --confirm to proceed","messagePattern":"this is a potentially destructive operation; pass --confirm to proceed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/commands/files.go","lineNumber":1732,"sourceCode":"  # Reset MFS to empty directory (recovery from corruption)\n  $ ipfs files chroot --confirm\n\n  # Restore MFS to a known good directory CID\n  $ ipfs files chroot --confirm QmYourBackupCID\n`,\n\t},\n\tArguments: []cmds.Argument{\n\t\tcmds.StringArg(\"cid\", false, false, \"New root CID (defaults to empty directory if not specified).\"),\n\t},\n\tOptions: []cmds.Option{\n\t\tcmds.BoolOption(chrootConfirmOptionName, \"Confirm this potentially destructive operation.\"),\n\t},\n\tNoRemote: true,\n\tExtra:    CreateCmdExtras(SetDoesNotUseRepo(true)),\n\tRun: func(req *cmds.Request, res cmds.ResponseEmitter, env cmds.Environment) error {\n\t\tconfirm, _ := req.Options[chrootConfirmOptionName].(bool)\n\t\tif !confirm {\n\t\t\treturn errors.New(\"this is a potentially destructive operation; pass --confirm to proceed\")\n\t\t}\n\n\t\tenc, err := cmdenv.GetCidEncoder(req)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\t// Determine new root CID\n\t\tvar newRootCid cid.Cid\n\t\tif len(req.Arguments) > 0 {\n\t\t\tvar err error\n\t\t\tnewRootCid, err = cmdutils.CidFromArg(req.Arguments[0])\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid CID %q: %w\", req.Arguments[0], err)\n\t\t\t}\n\t\t} else {\n\t\t\t// Default to empty directory\n\t\t\tnewRootCid = ft.EmptyDirNode().Cid()","sourceCodeStart":1714,"sourceCodeEnd":1750,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/commands/files.go#L1714-L1750","documentation":"The `ipfs files chroot` command replaces the MFS root, which discards the current root's contents from the operator's default view, so it refuses to run unless the caller explicitly passes --confirm. The check is a plain boolean read of the confirm option in the command's Run function.","triggerScenarios":"Running `ipfs files chroot <cid>` (or with no arguments, resetting to the empty dir) without `--confirm`; invoking the command from a script or API call that omits the chrootConfirmOptionName option.","commonSituations":"Copy-pasting an example that omitted --confirm; automation written before the guard was added; users unaware chroot is destructive by design (NoRemote, operates directly on the local repo).","solutions":["Re-run with `--confirm` once you understand the current root will be replaced: `ipfs files chroot --confirm <cid>`.","Record the current root first (`ipfs files stat /`) so you can chroot back later.","In scripts/API clients, set the confirm boolean option to true explicitly."],"exampleFix":"// before\nipfs files chroot bafybei...   # refused\n// after\nipfs files chroot --confirm bafybei...","handlingStrategy":"validation","validationCode":"ipfs files chroot --confirm \"$CID\"  # include --confirm; or check: ipfs files stat / | head -1","typeGuard":null,"tryCatchPattern":"err := runChroot(args, confirm)\nif err != nil && strings.Contains(err.Error(), \"--confirm to proceed\") {\n    return fmt.Errorf(\"chroot aborted: pass --confirm to replace the MFS root\")\n}","preventionTips":["Always pass --confirm in scripts that intend the replacement","Save the current root CID (`files stat /`) before chrooting so it can be restored","Run chroot interactively only; gate it in CI behind explicit approval"],"tags":["cli","destructive-operation","safety-guard","mfs"],"backgroundTag":"destructive-operation-requires-confirm","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}