{"record":{"id":"84c51b09fe1fb373","repo":"abhigyanpatwari/GitNexus","slug":"oracle-sanitization-left-clone-references-recovera","errorCode":null,"errorMessage":"oracle sanitization left clone references recoverable","messagePattern":"oracle sanitization left clone references recoverable","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/oracle_assets.py","lineNumber":417,"sourceCode":"            continue\n        if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISREG(metadata.st_mode):\n            raise ValueError(f\"unsafe Git metadata blocks oracle sanitization: {pseudo_ref}\")\n        path.unlink()\n\n    logs = git_dir / \"logs\"\n    if logs.exists() or logs.is_symlink():\n        logs_metadata = logs.lstat()\n        if stat.S_ISLNK(logs_metadata.st_mode) or not stat.S_ISDIR(logs_metadata.st_mode):\n            raise ValueError(\"unsafe Git reflog metadata blocks oracle sanitization\")\n        shutil.rmtree(logs)\n\n    _git_checked(root, [\"repack\", \"-A\", \"-d\"], timeout=600)\n    _git_checked(root, [\"prune\", \"--expire=now\"], timeout=600)\n    _git_checked(root, [\"prune-packed\"], timeout=600)\n\n    remaining_refs = _git_checked(root, [\"for-each-ref\", \"--format=%(refname)\"], timeout=60)\n    if remaining_refs:\n        raise ValueError(\"oracle sanitization left clone references recoverable\")\n    fsck = run_checked(\n        [\"git\", \"-C\", str(root), \"fsck\", \"--full\", \"--no-progress\", \"--no-reflogs\", \"--unreachable\"],\n        timeout=600,\n        tail_bytes=MAX_CLONE_REF_BYTES,\n    )\n    if fsck.stdout_tail.strip() or fsck.stderr_tail.strip():\n        raise ValueError(\"oracle sanitization left unreachable Git objects recoverable\")\n\n    forbidden_objects: list[tuple[str, str]] = []\n    if original_head != sanitized_head:\n        forbidden_objects.append((original_head, \"original commit\"))\n    if hidden_tree:\n        forbidden_objects.append((hidden_tree, \"hidden harness tree\"))\n    for forbidden_object, label in forbidden_objects:\n        probe = run_managed(\n            [\"git\", \"-C\", str(root), \"cat-file\", \"-e\", forbidden_object],\n            timeout=60,\n        )","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/oracle_assets.py#L399-L435","documentation":"Post-condition: after deleting every ref via `update-ref --no-deref -d`, a follow-up `for-each-ref` must return nothing. If any ref survives, the deletion was incomplete (packed refs, concurrent ref creation, or silent update-ref failure) and the clone is not fully sanitized.","triggerScenarios":"Triggered when refs remain after the deletion loop — typically packed-refs entries that update-ref -d did not remove, or a concurrent git process creating refs.","commonSituations":"A clone whose refs are stored in .git/packed-refs and update-ref left the packed entries; another process (IDE git daemon, concurrent task) writing refs during sanitization; git version quirk in update-ref packed handling.","solutions":["Run `git -C <clone> pack-refs --all --prune` then re-run for-each-ref to see survivors.","Manually delete surviving refs: `git -C <clone> update-ref -d <survivor>` (quote the name).","If packed-refs persists, edit or remove .git/packed-refs and run `git -C <clone> reflog expire --all && git -C <clone> gc --prune=now`.","Re-clone and sanitize with no other git process touching the clone."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"def is_refs_recoverable(exc: BaseException) -> bool:\n    return isinstance(exc, ValueError) and \"left clone references recoverable\" in str(exc)\n","tryCatchPattern":"try:\n    oracle_assets.sanitize_clone_for_hidden_oracles(clone)\nexcept ValueError as exc:\n    # Surviving refs imply oracle bytes may be reachable; discard the clone.\n    quarantine(clone)\n    raise AbortTask(str(exc)) from exc\n","preventionTips":["Run sanitization on an isolated, single-process clone.","Pre-emptively `git pack-refs --all --prune` so update-ref deletions cover packed refs."],"tags":["git","refs","packed-refs","postcondition","oracle","sanitization","invariant"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}