{"record":{"id":"af44ad458c682f2e","repo":"abhigyanpatwari/GitNexus","slug":"sanitized-graph-asset-must-be-regular-and-non-syml","errorCode":null,"errorMessage":"sanitized graph asset must be regular and non-symlink: {path}","messagePattern":"sanitized graph asset must be regular and non-symlink: (.+?)","errorType":"exception","errorClass":"SandboxError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/sanitized_graph.py","lineNumber":321,"sourceCode":"            \"-r\",\n            \"benchmark-target\",\n            \"--limit\",\n            \"1\",\n        ),\n        timeout=GRAPH_QUERY_TIMEOUT_SECONDS,\n        capture_stdout=True,\n    )\n    assert node_result is not None and relation_result is not None\n    _parse_empty_query(node_result, label=\"sanitized graph node proof\")\n    _parse_empty_query(relation_result, label=\"sanitized graph relation proof\")\n\n\ndef _validate_graph_metadata(root: Path, sanitized_head: str) -> None:\n    for name in (\"gitnexus.json\", \"meta.json\", \"lbug\"):\n        path = root / \".gitnexus\" / name\n        metadata = path.lstat()\n        if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISREG(metadata.st_mode):\n            raise SandboxError(f\"sanitized graph asset must be regular and non-symlink: {path}\")\n    try:\n        metadata_payload = json.loads((root / \".gitnexus\" / \"gitnexus.json\").read_text())\n    except (OSError, json.JSONDecodeError) as exc:\n        raise SandboxError(\"sanitized graph metadata is malformed\") from exc\n    if metadata_payload.get(\"lastCommit\") != sanitized_head:\n        raise SandboxError(\"sanitized graph metadata is not bound to the parentless task commit\")\n    if not isinstance(metadata_payload.get(\"pdg\"), dict) or not metadata_payload[\"pdg\"]:\n        raise SandboxError(\"sanitized graph metadata does not prove a --pdg build\")\n\n\ndef prepare_sanitized_graph(\n    task: Mapping[str, Any],\n    *,\n    repo: Path,\n    resolved_sha: str,\n    parent: Path,\n    cache: TaskAssetCache,\n    claude_bin: Path | str,","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/sanitized_graph.py#L303-L339","documentation":"In _validate_graph_metadata, each of .gitnexus/{gitnexus.json,meta.json,lbug} must be a regular non-symlink file (checked via lstat). A symlink or special file would let the target swap metadata after validation, so the harness rejects it.","triggerScenarios":"The target repo supplies .gitnexus/gitnexus.json (or meta.json/lbug) as a symlink to an external file, or as a FIFO/device/socket.","commonSituations":"A task reuses a prebuilt index by symlinking .gitnexus; a packaging step created the metadata via symlink; a tampering attempt to bind foreign metadata.","solutions":["Replace symlinked/special metadata files with real regular files, or remove .gitnexus so the harness rebuilds it.","Audit task declarations and validate_no_prebuilt_graph_assets to ensure no sandbox_copy/dependency imports .gitnexus/*.","Re-run graph preparation so the harness owns those files itself."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import os, stat\n\ndef assert_graph_assets_regular(root):\n    for name in (\"gitnexus.json\", \"meta.json\", \"lbug\"):\n        p = os.path.join(root, \".gitnexus\", name)\n        m = os.lstat(p)\n        if stat.S_ISLNK(m.st_mode) or not stat.S_ISREG(m.st_mode):\n            raise RuntimeError(f\"{p} must be a regular non-symlink file\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never symlink .gitnexus metadata files; let the harness build and own them.","Ensure validate_no_prebuilt_graph_assets blocks any sandbox_copy/dependency importing .gitnexus/*.","Remove a pre-existing .gitnexus before graph preparation so it is rebuilt cleanly."],"tags":["security","sandbox","filesystem","workflow-bench"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}