{"record":{"id":"8c91ea8952606fe4","repo":"paperclipai/paperclip","slug":"codex-startup-trust-git-resolution-failed","errorCode":"codex_startup_trust_git_resolution_failed","errorMessage":"codex_startup_trust_git_resolution_failed","messagePattern":"codex_startup_trust_git_resolution_failed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/paperclip-runner/src/drivers/codex/codex-startup-trust.ts","lineNumber":85,"sourceCode":"    const common = execFileSync(\n      \"git\",\n      [\n        \"-C\",\n        startup,\n        \"rev-parse\",\n        \"--path-format=absolute\",\n        \"--git-common-dir\",\n      ],\n      { encoding: \"utf8\", timeout: 5000, stdio: [\"ignore\", \"pipe\", \"ignore\"] },\n    ).trim();\n    // Linked worktrees share Codex's trust key with the main checkout.\n    root = realpathSync(common.endsWith(\"/.git\") ? dirname(common) : top);\n  } catch (error) {\n    // Non-Git folders have their own exact startup trust boundary. Failures\n    // inside a repository must not guess a different trust key.\n    for (let ancestor = startup; ; ancestor = dirname(ancestor)) {\n      if (existsSync(join(ancestor, \".git\")))\n        throw new Error(\"codex_startup_trust_git_resolution_failed\", {\n          cause: error,\n        });\n      if (dirname(ancestor) === ancestor) break;\n    }\n  }\n  mkdirSync(codexHome, { recursive: true, mode: 0o700 });\n  const path = join(codexHome, \"config.toml\");\n  const source = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const config = parse(source);\n  const projects = config.projects ?? {};\n  if (\n    typeof projects !== \"object\" ||\n    Array.isArray(projects) ||\n    projects instanceof Date\n  )\n    throw new Error(\"codex_startup_trust_invalid_projects\");\n  const project = projects[root] ?? {};\n  if (","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/packages/paperclip-runner/src/drivers/codex/codex-startup-trust.ts#L67-L103","documentation":"After computing the startup real path, the function resolves the Git repo trust root via git rev-parse --show-toplevel/--git-common-dir. If git fails AND the startup path (or an ancestor) contains a .git entry, the folder is a repository whose exact trust key could not be derived, so the function refuses to guess a different trust boundary and throws this error with the underlying cause.","triggerScenarios":"Running inside a Git worktree/repo where git rev-parse fails: corrupted .git, GIT_DIR/GIT_CEILING_DIRECTORIES interference, git binary missing on PATH, permission problems, or a .git file pointing to a missing worktree gitdir.","commonSituations":"Containers without git installed, detached/checked-out worktrees with stale .git files, restricted GIT_* env vars inherited by execFileSync, deeply nested paths excluded by ceiling directories.","solutions":["Run `git -C <startup> rev-parse --show-toplevel` manually and fix the underlying git error reported in error.cause.","Ensure the git binary is installed and on PATH inside the execution host.","Unset interfering GIT_DIR/GIT_WORK_TREE/GIT_CEILING_DIRECTORIES in the driver environment.","Repair or remove the broken .git entry (stale worktree gitdir) or re-clone the repository."],"exampleFix":"// before\n// inherited env breaks rev-parse\nconst env = {...process.env};\n// after\nconst { GIT_DIR, GIT_WORK_TREE, GIT_CEILING_DIRECTORIES, ...cleanEnv } = process.env;\n// pass cleanEnv to the driver that calls trustCodexStartupRoot","handlingStrategy":"try-catch","validationCode":"import { execFileSync } from 'node:child_process';\nfunction gitToplevel(cwd: string): string | null { try { return execFileSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], { stdio: ['ignore','pipe','ignore'] }).toString().trim(); } catch { return null; } }","typeGuard":"const hasGitEntry = (dir: string): boolean => existsSync(join(dir, '.git'));","tryCatchPattern":"try { trustCodexStartupRoot(codexHome, cwd); } catch (e) { if ((e as Error).message === 'codex_startup_trust_git_resolution_failed') { console.error('git failed inside repo:', (e as Error).cause); throw new Error('Fix git environment (binary on PATH, no GIT_DIR overrides) before running Codex.', { cause: e }); } throw e; }","preventionTips":["Install git in execution containers and verify with `git --version` at startup","Scrub GIT_DIR/GIT_WORK_TREE/GIT_CEILING_DIRECTORIES from the driver env","Repair stale worktree .git files before launching runs","Test trust setup on a plain non-git folder to isolate repo-specific git failures"],"tags":["codex","git","paths","startup-trust"],"backgroundTag":"git-command-failed","analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}